Security audit

ACT Runtime

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent for running ACT WebAssembly tools, but it can download remote components and grant broad filesystem access without enough guardrails.

Install only if you intend to use ACT components and trust the ACT CLI source. Prefer pinned, trusted OCI components; avoid arbitrary HTTP component URLs; do not use --allow-fs for remote or untrusted components; and only grant narrowly scoped directory access after checking the exact host path and purpose.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:33
Finding: Execution of Arbitrary Remote WebAssembly Components
Content: View full analysis
``` `` is one of: - OCI registry ref: `ghcr.io/actpkg/sqlite:0.1.0` - HTTP URL: `https://example.com/component.wasm` - Local file: `./component.wasm` The output contains: - `metadata_schema` — required configuration keys (pass via `--metadata`) - `tools` — list of tool names, descriptions, and `parameters_schema` Use `--format text` for a human-readable summary instead of JSON. ## Step 2: Call a tool ```bash act call --args '' [options] ``` Remote components are cached locally after first download. ``` ### Technical Analysis The skill permits `` to be an arbitrary HTTP URL and subsequently passes that reference to `act call`, causing externally hosted executable WebAssembly content to be downloaded and run. No source allowlist, cryptographic digest pinning, signature verification, provenance validation, or mandatory user confirmation is required. Consequently, the payload actually executed can differ from the payload reviewed previously. WebAssembly sandboxing reduces default host access but does not establish the trustworthiness of the component, particularly because the skill also documents mechanisms for granting filesystem capabilities. ### Attack Path 1. An attacker supplies or influences a component reference, such as an attacker-controlled HTTPS URL. 2. The agent runs `act info --tools` against that URL and treats the component-provided metadata as tool discovery output. 3. The agent invokes an exported tool using `act call`. 4. The remote component is downloaded, cached locally, and executed. 5. The component performs attacker-selected operations using its runtime capabilities and any permissions granted by the ...[truncated 485 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: SKILL.md:52
Finding: Unrestricted Host Filesystem Access Can Be Granted to Components
Content: View full analysis
'` | Tool parameters (matches `parameters_schema`) | | `--metadata ''` | Component config (matches `metadata_schema`) | | `--allow-dir guest:host` | Grant directory access to the sandbox | | `--allow-fs` | Grant full filesystem access | ``` ```markdown - Use `--allow-dir guest:host` only when the component needs filesystem access - Components run sandboxed in WebAssembly — no host access unless explicitly granted ``` ### Technical Analysis The documented `--allow-fs` option grants a component full filesystem access, removing a central least-privilege boundary of the WebAssembly sandbox. The skill does not prohibit this option for remote or untrusted components, restrict which host paths may be exposed, require read-only mappings, or require explicit user authorization. The recommendation to use `--allow-dir` only when needed does not adequately protect against overbroad access because no equivalent restriction is imposed on `--allow-fs`. A malicious or compromised component can exploit granted access using ordinary filesystem operations available through its component interface. ### Attack Path 1. An attacker causes the agent to select a malicious or compromised component. 2. The task is represented as requiring host filesystem access. 3. The agent invokes the component with `--allow-fs`, or maps a sensitive host directory using `--allow-dir`. 4. The component enumerates files available to the agent process. 5. It reads sensitive files, modifies project or configuration data, or destroys accessible content. 6. Where the component has a permitted output or network channel, acquired information may be disclosed outside the host. ### Impact Assessment The component may obtain the same filesystem v ...[truncated 425 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:22
Finding: Unpinned Global Installation of a Third-Party npm Package
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The activation text is broad enough to trigger on generic references to '.wasm', 'sandboxed tools', or 'SQLite/HTTP/filesystem' use cases, which can cause the skill to activate in contexts beyond explicit user intent. Because this skill can fetch remote components and supports privileged flags like '--allow-dir' and '--allow-fs', over-activation increases the chance of unnecessary execution of untrusted components or unintended expansion of filesystem access.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.