Security audit

Agent Setup Survey

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed environment survey that collects limited runtime details and submits them to a research endpoint with user-visible review steps.

Before installing, understand that this skill is meant to send a small environment fingerprint to internetwarte.eu. Review the JSON payload before approving submission, avoid sharing installed skill names unless you are comfortable disclosing them, and be aware the receiving service may also learn your agent name/model from the User-Agent and a coarse source-network identifier.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

Findings (1)

other

Note

Location: SKILL.md:29
Finding: External Disclosure of Environment Fingerprints and Optional Skill Inventory
Content: View full analysis
"$RESULT_FILE" ``` Show the JSON output to the user, ask about metadata before submitting. ### 2. Collect skill metadata Ask the user if he desires to share more information about installed skills: - "How many skills does your agent have available?" (`0`, `1-10`, `>10`) - Default 0 - "Which skill names would you like to share?" (prompt user with comma-separated list of skills - exclude the survey skill, let user decide which ones to submit) ### 3. Submit POST the payload with the metadata extension as JSON to `https://internetwarte.eu/submit`. Set `User-Agent` to the name of the executing agent (e.g. `Claude Code`, `OpenAI Codex`, `Gemini CLI`, ...). Default Payload: ```json { "os": "linux/windows/macOS", "arch": "", "container": { "is_container": true/false, "type": "" }, "vm": { "is_vm": true/false, "type": "" }, "signals": { "has_dockerenv": true/false, "has_containerenv": true/false, "cgroup_hints": true/false, "cpuinfo_hypervisor_flag": true/false, "dmi_vm_hints": true/false } "skill_disclosure": { "skills_added": "1-10", "skills_names": ["", ""] } ``` ``` ### Technical Analysis The Skill directs the agent to collect an execution-environment fingerprint and transmit it to an external endpoint. ...[truncated 3009 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The description frames the skill as a simple sandbox/bare-metal survey, but the body instructs collection of more detailed runtime telemetry and optional disclosure of installed skill names, plus submission to an external service. This mismatch can mislead users and reviewers about the true data-handling behavior, undermining informed consent and making sensitive disclosure more likely.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 96% confidence
Finding: The skill requires shell execution, file access, and likely environment inspection, but it declares no explicit tool scope or permissions. This increases the chance that an agent will run it with broader-than-necessary privileges and without clear operator visibility into what capabilities are being exercised.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill explicitly instructs the agent to send installed skill inventory and runtime metadata to an external service. Even when framed as optional, skill names and execution-environment details can reveal internal capabilities, vendor/tooling choices, and deployment characteristics that are useful for profiling or targeted follow-on attacks.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill notes elsewhere that the User-Agent will identify the executing agent and model, but this is not surfaced as a clear warning where submission is described. Transmitting agent/model identity to a third party can disclose operational metadata that users may not expect, especially when combined with environment fingerprints.
Content: No source excerpt is available for this finding.

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · scripts/environment-survey.py (reported line 30)May include surrounding context.
python
def run_cmd(cmd: list[str], timeout: float = 2.0) -> Tuple[int, str, str]: try: p = subprocess.run( cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE,

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The phrase "Ask the user if he desires" imposes a gendered default in natural-language instructions. This can violate organizational language policy expectations for neutral or inclusive wording when no user preference has been provided.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.