other
Error
- Location
SKILL.md:117- Finding
Remote Transmission of Raw Cryptographic Keys and Sensitive Data
- Content
View full analysis
- Remediation
View remediation
Security audit
Encrytion Decryption Toolkit
Security checks for vulnerabilities and agentic risk
Overview
The skill is a disclosed remote cryptography tool, but it can send raw private keys, encryption keys, HMAC secrets, and plaintext to AgentPMT with weak warnings and mutable remote instructions.
Review carefully before installing. Use this only if you explicitly trust AgentPMT to process the exact secrets and plaintext you provide. Avoid production private keys, wallet material, long-lived HMAC secrets, AES keys, credentials, and private files; prefer local crypto tools or KMS/HSM key references for sensitive work. Treat live remote instructions as untrusted unless independently reviewed, and avoid unpinned npx setup commands in production environments.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:313- Finding
Mutable Remote Instructions Override the Audited Local Skill
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:374- Finding
Unpinned Third-Party Skill Installation Through npx
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (15)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md --- name: encrytion-decryption-toolkit description: "Encryption Decryption Toolkit: Cryptographic toolkit: generate secure randoms, compute. Use when an agent needs encryption decryption toolkit, encrytion decryption toolkit, generating secure api keys or access tokens for authentication systems, creating unique uuids for database record identifiers, computing file checksums to verify data integrity during transfers, validating webhook payloads by computing and comparing hmac signatures, decrypt, value through AgentPMT-hosted remote tool calls." version: 1.0.1 homepage: https://www.agentpmt.com/marketplace/encrytion-decryption-toolkit compatibility: "Agent instructions for AgentPMT-hosted remote tool calls. Follow this skill body for supported account, wallet, and setup routes. No local command runtime is declared."
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md --- name: encrytion-decryption-toolkit description: "Encryption Decryption Toolkit: Cryptographic toolkit: generate secure randoms, compute. Use when an agent needs encryption decryption toolkit, encrytion decryption toolkit, generating secure api keys or access tokens for authentication systems, creating unique uuids for database record identifiers, computing file checksums to verify data integrity during transfers, validating webhook payloads by computing and comparing hmac signatures, decrypt, value through AgentPMT-hosted remote tool calls." version: 1.0.1 homepage: https://www.agentpmt.com/marketplace/encrytion-decryption-toolkit compatibility: "Agent instructions for AgentPMT-hosted remote tool calls. Follow this skill body for supported account, wallet, and setup routes. No local command runtime is declared."
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md --- name: encrytion-decryption-toolkit description: "Encryption Decryption Toolkit: Cryptographic toolkit: generate secure randoms, compute. Use when an agent needs encryption decryption toolkit, encrytion decryption toolkit, generating secure api keys or access tokens for authentication systems, creating unique uuids for database record identifiers, computing file checksums to verify data integrity during transfers, validating webhook payloads by computing and comparing hmac signatures, decrypt, value through AgentPMT-hosted remote tool calls." version: 1.0.1 homepage: https://www.agentpmt.com/marketplace/encrytion-decryption-toolkit compatibility: "Agent instructions for AgentPMT-hosted remote tool calls. Follow this skill body for supported account, wallet, and setup routes. No local command runtime is declared."
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill instructs users to perform
sign,encrypt, anddecryptusing a hosted remote tool, which necessarily involves transmitting highly sensitive material such as private keys, shared secrets, plaintext secrets, ciphertext, and API credentials to a third-party service. Although there is a brief security note later, the operational examples and workflows do not prominently warn before these dangerous operations, making inadvertent secret disclosure more likely.- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The activation keywords are broad phrases like generating API keys, access tokens, decrypt, and value, which can match many unrelated tasks. In an agent setting this increases accidental invocation of a remote crypto service, potentially causing sensitive plaintext, keys, or tokens to be sent off-host when the user did not explicitly request that tool.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 94% confidence
- Finding
The skill recommends installing related skills via
npx skills ...without pinning a specific package or skill version. That creates a supply-chain risk: a later upstream change, compromise, or typo-resolved package update could alter what gets installed and executed in the agent environment.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 94% confidence
- Finding
This line includes an unpinned
npx skillsinstallation command for a dependency skill. Because the referenced artifact is not version-locked, consumers may fetch unexpected code or changed instructions at install time, enabling supply-chain compromise or behavior drift.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 94% confidence
- Finding
The install script uses
npx skills add ...with no explicit version pinning. In an agent ecosystem, that can silently pull newer or maliciously modified package content, increasing supply-chain exposure.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 94% confidence
- Finding
A second unpinned
npx skills add ...command appears in the script block, carrying the same supply-chain risk as the others. Users following these instructions may install unreviewed updates or compromised dependencies.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 93% confidence
- Finding
The reference section again instructs users to install a related skill via an unpinned
npx skillscommand. Repetition of floating install guidance increases the chance operators will copy unsafe commands into production workflows.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 93% confidence
- Finding
This line repeats an unversioned install command for another related skill. Any compromise or incompatible update in the upstream distribution chain could affect downstream users who trust the documentation.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 92% confidence
- Finding
The skill explicitly directs agents to use external AgentPMT MCP and REST endpoints. In context, external transmission is core functionality rather than covert exfiltration, but it still creates real exposure because this skill handles cryptographic inputs that may include secrets, keys, tokens, plaintext, or decrypted material.
- Content
md - What AgentPMT is: ../what-is-agentpmt (ClawHub: `what-is-agentpmt`, page: https://clawhub.ai/agentpmt/what-is-agentpmt; skills.sh: `npx skills add AgentPMT/agent-skills --skill what-is-agentpmt`) - AgentPMT account MCP/REST setup: ../agentpmt-account-mcp-rest-api-setup (ClawHub: `agentpmt-account-mcp-rest-api-setup`, page: https://clawhub.ai/agentpmt/agentpmt-account-mcp-rest-api-setup; skills.sh: `npx skills add AgentPMT/agent-skills --skill agentpmt-account-mcp-rest-api-setup`) - Marketplace product: https://www.agentpmt.com/marketplace/encrytion-decryption-toolkit - AgentPMT main MCP server: https://api.agentpmt.com/mcp/ - AgentPMT REST invoke endpoint: https://api.agentpmt.com/products/purchase
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 92% confidence
- Finding
This line identifies the external REST invoke endpoint used to submit tool parameters remotely. Because the tool supports secret-bearing operations, the transmission path materially increases risk even if the service is legitimate, especially if agents pass credentials or cryptographic keys through it.
- Content
md - AgentPMT account MCP/REST setup: ../agentpmt-account-mcp-rest-api-setup (ClawHub: `agentpmt-account-mcp-rest-api-setup`, page: https://clawhub.ai/agentpmt/agentpmt-account-mcp-rest-api-setup; skills.sh: `npx skills add AgentPMT/agent-skills --skill agentpmt-account-mcp-rest-api-setup`) - Marketplace product: https://www.agentpmt.com/marketplace/encrytion-decryption-toolkit - AgentPMT main MCP server: https://api.agentpmt.com/mcp/ - AgentPMT REST invoke endpoint: https://api.agentpmt.com/products/purchase
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The manifest describes the skill as an encryption/decryption toolkit for secure random generation, UUIDs, checksums, HMAC validation, and decryption, but it does not mention asymmetric digital signing. This schema adds a distinct capability to create RSA/ECDSA signatures with private keys, which expands the advertised scope beyond the manifest's stated operations.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The schema documents operations that require highly sensitive material such as PEM private keys, HMAC secrets, and AES keys, but provides no warning about disclosure, logging, storage, or transmission risks. In an agent-mediated remote tool context, this can normalize sending long-lived secrets to external infrastructure, increasing the chance of key compromise through logs, traces, prompt leakage, or misuse by downstream systems.
- Content
Static analysis
No suspicious patterns detected.