Migma

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:09 PM UTC
• Version: 1.3.0

Overview

The skill matches its email-marketing purpose, but it gives an agent direct bulk-email and contact-list mutation powers without enough built-in safeguards.

Review this skill before installing. Use a scoped and rotatable Migma API key, pin or verify the @migma/cli package where possible, and require the agent to show recipients, audience counts, sender, subject, and content before any real send. Treat CSV imports and contact removals as sensitive data operations that need explicit confirmation and backups or auditability.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:14

Finding

Unpinned Executable npm Dependency

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 14–17
Vulnerability Type: Unpinned third-party executable dependency
Risk Level: Medium

Vulnerable Code

yaml

install:
  - kind: node
    package: "@migma/cli"
    bins: [migma]

Technical Analysis

The installation configuration specifies @migma/cli without an exact version, lockfile, checksum, or package integrity hash. Consequently, installation may resolve to a newer package release than the one originally reviewed.

Because this dependency supplies the executable migma command, a compromised or malicious future release could execute code through npm lifecycle hooks during installation or whenever the CLI is invoked. Normal use also gives the CLI access to MIGMA_API_KEY and passes email content, contact information, recipient addresses, and campaign details to it.

The audit found no evidence that the currently referenced package is malicious. The vulnerability is the absence of controls ensuring that future installations retrieve the same reviewed artifact.

Attack Path

1. An attacker compromises the npm publisher account, package release process, or another relevant supply-chain component for @migma/cli.
2. The attacker publishes an altered release containing malicious installation hooks or CLI behavior.
3. A user installs the Skill, and the unversioned dependency resolves to the altered release.
4. Malicious code executes during package installation or a subsequent migma invocation.
5. The code accesses data available to the process, potentially including MIGMA_API_KEY, email content, contacts, recipient information, and campaign configuration.
6. The attacker may exfiltrate those assets or use the API credential to perform actions permitted by the associated Migma account.

Impact Assessment

Successful exploitation could provide code execution with the privileges of the user or service installing and running the CLI. It could expose the Migma API ...[truncated 418 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin @migma/cli to a reviewed, exact version rather than allowing implicit resolution to the latest release.
2. Use a lockfile and verify the package with an integrity hash or equivalent reproducible-installation control.
3. Configure installation to use the expected npm registry and document the verified package publisher.
4. Disable npm lifecycle scripts where operationally feasible, or review all required lifecycle scripts before permitting execution.
5. Perform dependency provenance and signature verification when supported by the distribution channel.
6. Run the CLI with least privilege and expose MIGMA_API_KEY only to the process that requires it.
7. Scope and rotate API credentials so that compromise has limited duration and account impact.
8. Re-audit dependency updates before changing the pinned version.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (5)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill explicitly instructs an agent how to send emails to individual recipients, segments, and tags, but it provides no safeguard language requiring confirmation, recipient verification, or acknowledgment that content and recipient data will be transmitted to a third-party service. In an agentic context, this increases the risk of unintended bulk messaging, disclosure of personal data, spam, or reputational harm from autonomous execution of real-world outbound actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The contact-management section documents import and removal commands that can modify or delete audience data without any warning about destructive effects, data integrity risks, or the fact that personal contact information is being uploaded to an external system. In an autonomous or semi-autonomous workflow, this can lead to accidental deletion, unauthorized ingestion of PII, or large-scale unintended changes to customer datasets.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The workflow shows sending to an entire VIP tag without any explicit user-facing confirmation, preview, recipient count check, or guardrail before a bulk email action. In an agent-driven terminal workflow, this increases the chance of accidental mass emailing, which can cause privacy, compliance, and reputational harm even if the CLI command itself is valid.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The CSV contact import workflow shows uploading customer contact data without any warning about handling personal data, consent, or the risk of importing the wrong file. In a marketing-email context, this can result in unauthorized processing of PII, accidental ingestion of sensitive data, and downstream compliance issues if imported contacts are later emailed.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

The website import example instructs the tool to fetch and process content from an external URL but does not warn that third-party site data will be retrieved and used to build project assets. This can lead to unintended processing of external content, branding mistakes, or importing data from an incorrect or unauthorized site, though the impact is limited compared with bulk sending or contact upload.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.