Marrs

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 5:25 AM UTC
• Version: 1.6.0

Overview

This skill is a small, disclosed RAG memory helper, but users should treat any saved memory text as potentially sensitive before sending it to a configured backend.

Install only if you intend to send selected memory text to a RAG backend you control. Pin dependencies, review the short scripts, configure RAG_URL carefully, and add redaction/access-control rules before saving prompts, credentials, private notes, or internal data.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:12

Finding

Unpinned Third-Party Dependency Creates Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 12
Vulnerability Type: Unpinned third-party dependency
Risk Level: Medium

Vulnerable Code

markdown

2. `pip install requests` (the only external dependency).

Technical Analysis

The installation instruction does not constrain requests to a reviewed version and does not provide a lockfile or cryptographic hashes. Consequently, package resolution can vary over time and can include unreviewed versions of requests or its transitive dependencies.

This creates supply-chain exposure because the code ultimately installed is not identical to the code assessed during this audit. Exploitation would require the relevant package distribution, package index, dependency resolution path, or a transitive dependency to become compromised. No evidence was found that the currently named requests package is malicious; the issue is the mutable and unverified installation process.

Attack Path

1. A user follows the setup instructions and runs pip install requests.
2. pip resolves the latest compatible package and transitive dependencies from its configured package index.
3. An attacker compromises a resolved release, its distribution channel, or a transitive dependency.
4. The compromised package is downloaded and installed without hash verification.
5. Malicious package code can execute during installation or when imported by scripts/save_memory.py.
6. The code runs with the privileges of the user or service operating the Skill.

Impact Assessment

Successful exploitation could provide arbitrary Python code execution within the Skill's runtime environment. The attacker could access files, environment variables, network resources, and credentials available to that process. The maximum scope is limited by the operating-system privileges and isolation controls applied to the installing or executing user; this issue does not independently provi ...[truncated 24 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the unconstrained installation instruction with a dependency file that pins a reviewed version of requests and all transitive dependencies.
2. Generate and record cryptographic hashes for every permitted distribution.
3. Require hash validation during installation, for example:

   bash

   python -m pip install --require-hashes -r requirements.txt
   

4. Maintain the lockfile through a controlled dependency-update process that includes vulnerability scanning and review of release changes.
5. Install dependencies inside a dedicated virtual environment or isolated container using a non-privileged account.
6. Configure pip to use a trusted package index and avoid unreviewed additional indexes that could enable dependency-confusion attacks.
7. Document the exact supported Python and dependency versions so deployments remain reproducible.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The skill markets itself as fully generic and complete, while the observed content does not show the claimed monitor/defrag templates, hot queue logic, or evidence supporting the broad assertions. In a security review context, overstated or inaccurate descriptions are dangerous because they can mask undisclosed behavior, confuse operators about what is actually installed, and weaken change-control and audit processes.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence

Finding

The skill markets itself as fully generic and complete, while the observed content does not show the claimed monitor/defrag templates, hot queue logic, or evidence supporting the broad assertions. In a security review context, overstated or inaccurate descriptions are dangerous because they can mask undisclosed behavior, confuse operators about what is actually installed, and weaken change-control and audit processes.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The documentation explicitly instructs users to modify the helper to send memory content to a RAG backend ingest API, but it provides no warning about the sensitivity of that content or the need for data minimization, sanitization, or access controls. In an agent-memory context, stored text can easily include user prompts, credentials, internal system instructions, or other confidential data, so this omission creates a realistic risk of unintended exfiltration or over-collection.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/save_memory.py (reported line 27)May include surrounding context.

python

}
    
    try:
        resp = requests.post(f"{RAG_URL}/ingest", json=payload, timeout=30)
        if resp.status_code in (200, 201):
            print(f"  → Successfully saved to {collection}")
            return {"status": "success", "collection": collection}

Static analysis

No suspicious patterns detected.