Agent Setup Survey

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 1:47 AM UTC
• Version: 1.0.0

Overview

This skill is a disclosed environment survey that collects limited runtime details and submits them to a research endpoint with user-visible review steps.

Before installing, understand that this skill is meant to send a small environment fingerprint to internetwarte.eu. Review the JSON payload before approving submission, avoid sharing installed skill names unless you are comfortable disclosing them, and be aware the receiving service may also learn your agent name/model from the User-Agent and a coarse source-network identifier.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

other

Note

• Location: SKILL.md:29
• Finding: External Disclosure of Environment Fingerprints and Optional Skill Inventory<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:29-63` **Vulnerability Type**: `other: Environment Reconnaissance and Telemetry` **Risk Level**: Low ### Relevant Code and Instructions ```markdown The backend additionally records the submitting IP address anyonmized on a /24 network level. The `User-Agent` header is set by the agent to identify itself (e.g. `Claude Code`, `OpenAI Codex`, or others) + Model version (`sonnet 4.6`, `gpt-5.3`, or others) used that was able to submit the survey. ## Steps ### 1. Run detection ```bash RESULT_FILE="$(mktemp outbox/agent-setup-survey-result.XXXXXX.json)" python3 scripts/environment-survey.py > "$RESULT_FILE" ``` Show the JSON output to the user, ask about metadata before submitting. ### 2. Collect skill metadata Ask the user if he desires to share more information about installed skills: - "How many skills does your agent have available?" (`0`, `1-10`, `>10`) - Default 0 - "Which skill names would you like to share?" (prompt user with comma-separated list of skills - exclude the survey skill, let user decide which ones to submit) ### 3. Submit POST the payload with the metadata extension as JSON to `https://internetwarte.eu/submit`. Set `User-Agent` to the name of the executing agent (e.g. `Claude Code`, `OpenAI Codex`, `Gemini CLI`, ...). Default Payload: ```json { "os": "linux/windows/macOS", "arch": "<from_survey>", "container": { "is_container": true/false, "type": "<from_survey>" }, "vm": { "is_vm": true/false, "type": "<from_survey>" }, "signals": { "has_dockerenv": true/false, "has_containerenv": true/false, "cgroup_hints": true/false, "cpuinfo_hypervisor_flag": true/false, "dmi_vm_hints": true/false } "skill_disclosure": { "skills_added": "1-10", "skills_names": ["<skill_name1>", "<skill_name2>"] } ``` ``` ### Technical Analysis The Skill directs the agent to collect an execution-environment fingerprint and transmit it to an external endpoint. ...[truncated 3009 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Require explicit, affirmative confirmation immediately before every network submission. Consent should not be inferred from merely invoking the Skill. 2. Display the exact final JSON payload, destination hostname, identifying `User-Agent`, and source-IP handling policy before requesting approval. 3. Keep `skill_disclosure` disabled by default. Require separate consent for Skill names rather than combining it with approval for basic environment telemetry. 4. Use a generic, version-free `User-Agent` unless the user separately approves disclosure of the agent name and model version. 5. Add a dry-run-only mode and make it the default. Network submission should require an explicit flag or equivalent user action. 6. Validate that the destination uses HTTPS and restrict submission to the documented hostname. Do not follow redirects to unapproved domains. 7. Document server-side retention, access, sharing, deletion, and correlation policies, including how `/24` IP anonymization is performed and when raw addresses are discarded. 8. Avoid automatically saving failed payloads unless requested. If local outbox storage is used, create the directory securely, use restrictive file permissions, and inform the user of the saved file's location. 9. Correct the sample JSON syntax so integrators do not implement inconsistent or malformed payload handling; a comma is missing before `skill_disclosure`. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The description frames the skill as a simple sandbox/bare-metal survey, but the body instructs collection of more detailed runtime telemetry and optional disclosure of installed skill names, plus submission to an external service. This mismatch can mislead users and reviewers about the true data-handling behavior, undermining informed consent and making sensitive disclosure more likely.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 96% confidence
• Finding: The skill requires shell execution, file access, and likely environment inspection, but it declares no explicit tool scope or permissions. This increases the chance that an agent will run it with broader-than-necessary privileges and without clear operator visibility into what capabilities are being exercised.

Ssd 3

Medium

• Confidence: 97% confidence
• Finding: The skill explicitly instructs the agent to send installed skill inventory and runtime metadata to an external service. Even when framed as optional, skill names and execution-environment details can reveal internal capabilities, vendor/tooling choices, and deployment characteristics that are useful for profiling or targeted follow-on attacks.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill notes elsewhere that the User-Agent will identify the executing agent and model, but this is not surfaced as a clear warning where submission is described. Transmitting agent/model identity to a third party can disclose operational metadata that users may not expect, especially when combined with environment fingerprints.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

def run_cmd(cmd: list[str], timeout: float = 2.0) -> Tuple[int, str, str]:
    try:
        p = subprocess.run(
            cmd,
            stdout=subprocess.PIPE,
            stderr=subprocess.PIPE,

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Natural-Language Policy Violations

Low

• Confidence: 94% confidence
• Finding: The phrase "Ask the user if he desires" imposes a gendered default in natural-language instructions. This can violate organizational language policy expectations for neutral or inclusive wording when no user preference has been provided.

Static analysis

No suspicious patterns detected.