Security audit

Erc8004 Discover

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a coherent agent-discovery utility, but it can make user-hosted requests to arbitrary metadata URLs and uses an unsafe shared /tmp cache.

Install only if you are comfortable with discovery queries being sent to Agentscan and with agent info lookups potentially fetching metadata from third-party URLs. Avoid running the monitor command as root or on shared systems until the cache is moved to a private per-user directory and metadata fetching is restricted or made opt-in.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/discover.py:97
Finding: Unrestricted Metadata URL Fetching Enables Server-Side Request Forgery
Content: View full analysis
80 else ''}") metadata = decode_metadata_uri(metadata_uri) ``` ### Technical Analysis The `metadata_uri` value originates from agent data returned by the Agentscan API. An agent registrant who controls that field can supply an arbitrary HTTP or HTTPS URL. The code passes the URL to `api_request()`, which ultimately invokes `urllib.request.urlopen()`. There is no validation of: - The destination hostname or resolved IP address - Loopback, private, link-local, reserved, or unspecified address ranges - Cloud instance metadata addresses such as `169.254.169.254` - Redirect destinations - Plain HTTP usage - Response size or expected content type As a result, selecting a malicious agent with the `info` command can make the client issue requests to services reachable from the victim's environment. Automatic redirect handling may also allow an initially public URL to redirect to a prohibited internal destination. Fetching remote metadata is related to the declared information-display functionality, but unrestricted access to arbitrary network destinations exceeds the minimum privileges required. Metadata retrieval could instead be restricted ...[truncated 1400 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/discover.py:447
Finding: Predictable Shared Temporary Cache File Permits Symlink-Based File Overwrite
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill documents commands that use network access to query the Agentscan API and file write access to store monitor cache files under /tmp, but it does not declare any tool scope such as permissions or allowed-tools. This creates an implicit capability mismatch: an agent runner may permit broader execution than users expect, increasing the chance of unauthorized network calls or filesystem modifications when the skill is invoked.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: decode_metadata_uri dereferences attacker-controlled metadata_uri values over HTTP(S) and IPFS. Because agent metadata comes from external registry content, this creates unbounded outbound requests to third-party endpoints, enabling SSRF-style access to internal services, unexpected data egress, or tracking when users inspect an agent.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The monitor command persists agent state to /tmp, which expands the tool from pure discovery into local stateful behavior. On multi-user systems, predictable files in /tmp can expose monitored agent data to other local users or be tampered with, and the behavior is not clearly disclosed by the skill description.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The README states that the tool uses the public Agentscan API, but it does not clearly warn users that their search terms and agent identifiers are transmitted to a third-party service. This creates a privacy and operational security concern because potentially sensitive queries, addresses, or names may be disclosed outside the local environment without explicit user awareness.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The code fetches arbitrary HTTP(S) metadata without a clear user-facing warning. Even if intentional, silent network access to third-party endpoints can leak operator IP/addressing information and surprise users who expect the tool to talk only to the primary Agentscan API.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The monitor command writes persistent cache data to /tmp without making that behavior explicit in the command interface. This is primarily a transparency and privacy issue: users may not realize inspection state is being retained locally across runs.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.