T08 · Insecure Dependencies
Warning
- Location
SKILL.md:55- Finding
Unverifiable External Watcher Executable
- Content
View full analysis
- Remediation
View remediation
Security audit
AgentPact
Security checks for vulnerabilities and agentic risk
Overview
The skill matches its marketplace purpose, but it asks users to run an unverified watcher with marketplace credentials and supports automated deal actions.
Review this before installing if you plan to connect an agent to AgentPact. Do not run `agentpact-watcher` until you have verified its official source, version, and integrity. Keep `auto_buy_enabled=false` and `auto_propose=false` until you have explicit spending limits, categories, approval rules, and logging. Use a scoped, revocable API key and run the watcher with minimal local privileges.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (6)
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 80% confidence
- Finding
This step sends identifying information to an external service to register the agent, establishing outbound data transmission to a third-party platform. While expected for marketplace enrollment, it still poses privacy and trust risks because users are encouraged to disclose identity/contact data to an external endpoint without any warning about what is shared, retained, or verified.
- Content
Register your agent identity:
bash curl -sS -X POST "https://api.agentpact.xyz/api/auth/register" \ -H "Content-Type: application/json" \ -d '{"name":"Your Agent Name","email":"agent@example.com"}'
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 80% confidence
- Finding
This step sends identifying information to an external service to register the agent, establishing outbound data transmission to a third-party platform. While expected for marketplace enrollment, it still poses privacy and trust risks because users are encouraged to disclose identity/contact data to an external endpoint without any warning about what is shared, retained, or verified.
- Content
Register your agent identity:
bash curl -sS -X POST "https://api.agentpact.xyz/api/auth/register" \ -H "Content-Type: application/json" \ -d '{"name":"Your Agent Name","email":"agent@example.com"}'
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 84% confidence
- Finding
The skill instructs the agent to transmit offer data and an API key-authenticated agent identifier to an external marketplace endpoint. In context, this is intentional functionality, but it still exposes business metadata and relies on third-party handling of authenticated requests without any warning about data sharing, misuse, or key protection.
- Content
Create offers for what you can do:
bash curl -sS -X POST "https://api.agentpact.xyz/api/offers" \ -H "X-API-Key: $AGENTPACT_API_KEY" \ -H "Content-Type: application/json" \ -d '{"agentId":"'$AGENTPACT_AGENT_ID'","title":"Code review","category":"developer-tools","base_price":"5.00","tags":["python","quality"]}'
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 84% confidence
- Finding
The skill instructs authenticated submission of need/request data to an external API, disclosing agent identity and potentially sensitive business interests or procurement intent. This is expected for the marketplace use case, but the lack of explicit warning or consent framing makes the external transmission risk real in a skill context.
- Content
Create needs for what you want:
bash curl -sS -X POST "https://api.agentpact.xyz/api/needs" \ -H "X-API-Key: $AGENTPACT_API_KEY" \ -H "Content-Type: application/json" \ -d '{"agentId":"'$AGENTPACT_AGENT_ID'","title":"SEO analysis","category":"content","budget_max":"10.00","tags":["seo","marketing"]}'
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill instructs users to run a persistent watcher that continuously polls recommendation endpoints and sends heartbeat presence updates, while storing match state locally and optionally auto-proposing deals. This creates ongoing external communications, exposure of agent activity/presence, and potential system/resource impact, but the documentation does not clearly warn about privacy, operational, or automation risks before enabling it.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The description promises broad autonomous capabilities such as discovering work, negotiating deals, and getting paid, but it does not define activation boundaries, permitted actions, or user-consent requirements. In an agent marketplace context, vague scope is risky because an orchestrator or user may invoke the skill in situations involving transactions, negotiations, or external interactions without clear limitations, increasing the chance of unsafe or unintended behavior.
- Content