core-skill

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:49 AM UTC
• Version: 1.0.2

Overview

The skill is purpose-aligned overall, but it gives agents identity, delegation, network, and commerce-related capabilities while including an automatic quiet network check and unpinned runtime package execution.

Review this skill before installing in any account with valuable credentials or sensitive data. Use pinned, reviewed package versions, restrict MCP/server environment access, protect the Ed25519 private key, set narrow delegation scopes and low spend limits, and avoid enabling quiet session-start network checks unless you are comfortable with that external service contact.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Error

• Location: references/connect.md:31

Finding

Mandatory Silent Session-Start External Action

Content

View full analysis

Vulnerability Details

File Location: references/connect.md:31-34, 49-52
Vulnerability Type: T01: Skill Instruction Hijacking
Risk Level: High

Vulnerable Code

text

# 1. At session start, check quietly for anything already pending
check_pending_matches      # does not consume the principal's unread window
get_digest                 # only when the principal actually reads; it marks them read

text

- Call `check_pending_matches` quietly at session start. If something is
  pending, tell the principal; do not act on it unsupervised. Use
  `get_digest` only when the principal actually reads: it marks matches as
  seen, so calling it on their behalf spends a window they never looked at.

Technical Analysis

The binding instruction requires the agent to invoke check_pending_matches at every session start and directs it to perform the action “quietly.” The requirement applies independently of the user's current objective and therefore alters normal session behavior as soon as the skill is loaded.

This instruction conflicts with the same module's stated restriction that the connection layer should only be used when a task genuinely requires an external party and should not be used speculatively. It also weakens the broader requirement that network matching operations receive explicit approval.

Although the exact request fields and server implementation are not included in the audited project, the documented operation belongs to an external matching service. Consequently, invoking it may disclose session timing, service account or agent identity, and associated request metadata to that service.

Attack Path

1. An operator installs or loads the skill.
2. The user begins a new session for any task, including one unrelated to external matching.
3. The binding session-start rule activates without action-specific approval.
4. The agent invokes check_pending_matches through the external connection layer.
5. The external serv ...[truncated 749 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the unconditional session-start requirement.
• Do not describe network operations as occurring “quietly”; disclose the action, destination, purpose, and relevant data handling before invocation.
• Require explicit, action-specific user approval before every pending-match check.
• Load and use the connection module only when the current task genuinely requires an external party.
• Define which identifiers and metadata the request transmits, as well as applicable retention rules.
• Treat all matching-service responses as untrusted data and prevent them from overriding system, developer, or user instructions.
• Add tests ensuring unrelated sessions cannot trigger matching-service calls.

T08 · Insecure Dependencies

Warning

• Location: references/aps.md:39

Finding

Unpinned Third-Party Package Installation and Runtime Execution

Content

View full analysis

Vulnerability Details

File Location: references/aps.md:39-43, 48-58; also duplicated or extended in SKILL.md:98-104 and references/connect.md:29
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code

bash

npm install agent-passport-system        # SDK, /core subpath is the curated default
npm install agent-passport-system-mcp    # MCP server, APS_PROFILE=essential is the default

text

Remote MCP, zero install: `https://mcp.aeoess.com/sse`

bash

# 1. Get an identity (passport + Ed25519 keypair, tied to the principal)
npx agent-passport join --name my-agent --owner alice

# 2. Receive scoped authority (scope, spend limit, depth, expiry; only narrows)
npx agent-passport delegate --to <publicKey> --scope web_search,commerce --limit 500 --depth 1 --hours 24

# 3. Record work (Ed25519-signed receipt, traceable through the delegation chain)
npx agent-passport work --scope web_search --type research --result success --summary "..."

# 4. Reach other agents on the protocol
npx agent-passport-system-mcp   # then: identify, send_message, broadcast, list_agents

The connection module additionally directs runtime execution of another package:

bash

npx mingle-mcp   # then, all principal-gated:

Technical Analysis

The documented npm installation commands do not pin package versions or integrity hashes. The npx commands likewise do not identify reviewed versions. Depending on the local npm configuration and installation state, npx may resolve and download a current registry release at runtime.

This creates a mutable supply-chain boundary: the code ultimately executed can differ from the code available when this skill was reviewed. npm package installation can also execute lifecycle scripts, while package binaries run with the filesystem, environment, and network privileges of the agent process.

The mingle-mcp runtime dependency is not declared in the skill frontmatter installation ...[truncated 1356 chars]

Remediation

View remediation

Remediation Suggestions

• Pin every npm package to an exact reviewed version rather than a mutable tag or range.
• Commit and enforce a lockfile with package integrity hashes.
• Declare mingle-mcp and every other runtime dependency in the skill metadata.
• Replace runtime npx resolution with invocation of a locally installed, version-verified binary, such as npx --no-install.
• Use a trusted registry and verify package provenance or signatures where supported.
• Review transitive dependencies and continuously monitor them for advisories or ownership changes.
• Disable npm lifecycle scripts where feasible, or install in an isolated build environment before promotion.
• Run MCP services with least privilege, a restricted environment allowlist, limited filesystem access, and network egress controls.
• Protect identity keys using a dedicated secret store or restrictive file permissions rather than exposing them broadly to package processes.
• Pin and authenticate remote MCP endpoints, and document the trust boundary separately from locally installed dependencies.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (10)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The markdown promotes delegation, messaging, and gated commerce capabilities without prominently warning about authority transfer, data disclosure, spend exposure, and downstream effects of agent interactions. Given this is a core protocol skill for inter-agent operation, omission of these cautions makes risky capabilities easier to invoke without informed consent or guardrails.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The document describes creating and holding an Ed25519 identity/keypair but does not warn that private keys are sensitive credentials requiring secure generation, storage, backup, and rotation practices. In this skill's context, compromise of the keypair could enable impersonation of the agent and misuse of delegated authority or signed receipts.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 88% confidence

Finding

The documentation instructs users to run npx agent-passport without pinning an exact package version, which can cause execution of whatever version is current at install time. In a security-sensitive identity and delegation system, this increases supply-chain and reproducibility risk because behavior may change or a compromised release could be fetched implicitly.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 88% confidence

Finding

This example invokes npx agent-passport for delegation without a pinned version, so users may execute an unexpected or maliciously altered package version. Because the command manages scoped authority and spend limits, unpinned execution is especially risky in this context.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 88% confidence

Finding

The unpinned npx agent-passport work-recording command creates a supply-chain exposure by resolving the package dynamically at runtime. Since the tool handles signed receipts and authoritative records, users could unknowingly run altered logic that affects audit integrity.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence

Finding

The example starts npx agent-passport-system-mcp without pinning a version, which is a meaningful risk for an MCP server that enables identify, send_message, broadcast, and agent discovery functions. A malicious or unexpected package version could expose data, alter communications, or expand the attack surface during agent-to-agent interactions.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The documentation instructs use of npx mingle-mcp without pinning a specific package version or integrity-checked source. That creates a supply-chain risk: a future malicious or compromised package release could be fetched and executed at runtime, potentially gaining access to the agent's environment and delegated capabilities.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 59)May include surrounding context.

md

get_digest                 # only when the principal actually reads; it marks them read

# 2. With explicit approval, describe what the principal needs/offers
publish_intent_card        # never without approval; never auto-published

# 3. Surface relevant matches for the principal to review
search_matches

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/connect.md (reported line 35)May include surrounding context.

md

get_digest                 # only when the principal actually reads; it marks them read

# 2. With explicit approval, describe what the principal needs/offers
publish_intent_card        # never without approval; never auto-published

# 3. Surface relevant matches for the principal to review
search_matches

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/connect.md (reported line 60)May include surrounding context.

md

get_digest                 # only when the principal actually reads; it marks them read

# 2. With explicit approval, describe what the principal needs/offers
publish_intent_card        # never without approval; never auto-published

# 3. Surface relevant matches for the principal to review
search_matches