T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:239- Finding
Mutable Remote Instructions Are Trusted Over the Audited Skill
- Content
View full analysis
- Remediation
View remediation
Security audit
Google Contacts
Security checks for vulnerabilities and agentic risk
Overview
The skill is a real Google Contacts connector, but it gives mutable remote instructions authority over reviewed local instructions while handling sensitive contact data and destructive contact changes.
Review before installing. This skill should only be used with an AgentPMT/Google account you intend to expose to contact search, listing, creation, update, and permanent deletion. Avoid letting an agent automatically run the unpinned npx setup commands, and do not treat remote get_instructions text as permission to go beyond the six documented Google Contacts actions or the user's explicit request.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (2)
T03 · Remote Payload Retrieval and Execution
Warning
- Location
SKILL.md:302- Finding
Unpinned Remote Packages and Skills Are Executed Through npx Installation Commands
- Content
View full analysis
- Remediation
View remediation
...`. 2. Use a lockfile and verify npm integrity metadata before execution. 3. Pin `AgentPMT/agent-skills` to an immutable commit hash or signed release rather than a mutable repository reference. 4. Publish and verify cryptographic checksums or signatures for downloaded skill artifacts. 5. Prefer installing separately audited setup skills from a trusted local bundle instead of executing a network-fetched installer. 6. Disable lifecycle scripts where feasible and run installation in a sandbox with no access to user credentials, SSH keys, cloud metadata, or unrelated project files. 7. Do not permit an agent to execute installation commands automatically. Require explicit user review and confirmation. 8. Perform credential authorization only after package and skill integrity has been verified. 9. Restrict installer egress to approved package and AgentPMT endpoints. 10. Document the exact expected package version, source commit, publisher identity, and integrity digest in `SKILL.md`. ]]>
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (12)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill processes PII-rich contact records and sends them through AgentPMT to Google APIs, but the top-level description does not clearly warn that names, emails, phone numbers, addresses, notes, and company details may be transmitted to external services. In an agent ecosystem, missing privacy disclosure increases the chance that an agent forwards more user data than expected or without appropriate consent.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The activation keywords are broad and repetitive enough that an orchestrating agent may invoke this skill in loosely related contexts involving people, contacts, or conversation context. Because the tool can search, create, update, and permanently delete Google contacts, unintended activation could expose or modify sensitive personal data in an external system.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md - What AgentPMT is: ../what-is-agentpmt (ClawHub: `what-is-agentpmt`, page: https://clawhub.ai/agentpmt/what-is-agentpmt; skills.sh: `npx skills add AgentPMT/agent-skills --skill what-is-agentpmt`) - AgentPMT account MCP/REST setup: ../agentpmt-account-mcp-rest-api-setup (ClawHub: `agentpmt-account-mcp-rest-api-setup`, page: https://clawhub.ai/agentpmt/agentpmt-account-mcp-rest-api-setup; skills.sh: `npx skills add AgentPMT/agent-skills --skill agentpmt-account-mcp-rest-api-setup`) - Marketplace product: https://www.agentpmt.com/marketplace/google-contacts - AgentPMT main MCP server: https://api.agentpmt.com/mcp/ - AgentPMT REST invoke endpoint: https://api.agentpmt.com/products/purchase
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md - What AgentPMT is: ../what-is-agentpmt (ClawHub: `what-is-agentpmt`, page: https://clawhub.ai/agentpmt/what-is-agentpmt; skills.sh: `npx skills add AgentPMT/agent-skills --skill what-is-agentpmt`) - AgentPMT account MCP/REST setup: ../agentpmt-account-mcp-rest-api-setup (ClawHub: `agentpmt-account-mcp-rest-api-setup`, page: https://clawhub.ai/agentpmt/agentpmt-account-mcp-rest-api-setup; skills.sh: `npx skills add AgentPMT/agent-skills --skill agentpmt-account-mcp-rest-api-setup`) - Marketplace product: https://www.agentpmt.com/marketplace/google-contacts - AgentPMT main MCP server: https://api.agentpmt.com/mcp/ - AgentPMT REST invoke endpoint: https://api.agentpmt.com/products/purchase
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
This markdown schema documents actions that collect and send personally identifiable contact information such as names, email addresses, phone numbers, addresses, and notes, but it does not include any warning about transmitting that data to Google Contacts. Under the markdown-file criteria, user-facing documentation should warn when behavior could affect user privacy or external data handling.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 72% confidence
- Finding
The get_contact, list_contacts, and search_contacts actions are described as retrieving or searching contact records, which can reveal personal data, but the markdown provides no warning that these operations access potentially sensitive contact information from a third-party account. For markdown descriptions, omission of privacy-impact warnings is in scope when behavior affects user data.
- Content
Static analysis
No suspicious patterns detected.