other
Warning
- Location
SKILL.md:538- Finding
Unnecessary Remote Disclosure of Arbitrary User Text
- Content
View full analysis
- Remediation
View remediation
Security audit
Text Manipulation And Converter
Security checks for vulnerabilities and agentic risk
Overview
This skill is a disclosed AgentPMT-hosted text utility, but users should avoid sending confidential text and should be careful with the optional unpinned setup commands.
Install only if you are comfortable sending the text you submit to AgentPMT's remote service. Do not use it for secrets, private keys, credentials, regulated data, confidential logs, customer records, or proprietary source unless that remote processing is approved. Prefer pinned or trusted installation paths for the related setup skills instead of bare npx commands.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:524- Finding
Execution and Installation of Unpinned Third-Party Dependencies
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (12)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The top-level description markets text manipulation features but does not prominently warn that submitted text is processed via AgentPMT-hosted remote tool calls. This can mislead users and downstream agents into sending confidential text off-platform without informed consent, which is especially risky because the skill is designed to process arbitrary imported data and documents.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The activation guidance includes broad, everyday phrases such as cleaning text, formatting widths, quotes, and word/character count requirements. Overly generic triggers can cause unintended invocation of a remote tool, leading to accidental transmission of user content to an external service when the user did not explicitly request that integration.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 90% confidence
- Finding
The skill instructs users to install supporting skills via
npx skills ...without pinning an exact package/version. Unpinned remote package execution creates a supply-chain risk: a compromised upstream package, dependency, or future breaking release could execute unintended code during installation or alter the installed skill behavior.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 90% confidence
- Finding
This line recommends
npx skillsinstallation without a pinned version, which delegates trust to the latest upstream package at execution time. If the package or one of its dependencies is malicious or compromised, users may run attacker-controlled code during setup.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 90% confidence
- Finding
Using
npx skillshere again introduces an avoidable supply-chain exposure because the toolchain version is not fixed. The risk is amplified by this being setup guidance, where users may run the command directly with elevated trust.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 90% confidence
- Finding
This installation example is also unpinned and therefore susceptible to upstream compromise or silent behavior changes. Security-sensitive setup instructions should be deterministic; otherwise, the same documented command may install different code over time.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 90% confidence
- Finding
The referenced
npx skillscommand lacks version pinning, creating the same supply-chain and reproducibility risk as the earlier occurrences. Users following documentation may inadvertently install altered code if the upstream package changes or is hijacked.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 90% confidence
- Finding
Another unpinned
npx skillsinvocation appears in reference material, reinforcing insecure installation practices. Repeated insecure setup commands increase the chance that consumers will execute unreviewed remote code as part of onboarding.- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 86% confidence
- Finding
The skill directs agents to an external AgentPMT MCP server endpoint, which means user-provided text may leave the local environment. In this context, external transmission is an expected product behavior, but it still represents a real confidentiality risk because the tool handles arbitrary text that may contain secrets, proprietary data, or personal information.
- Content
md - What AgentPMT is: ../what-is-agentpmt (ClawHub: `what-is-agentpmt`, page: https://clawhub.ai/agentpmt/what-is-agentpmt; skills.sh: `npx skills add AgentPMT/agent-skills --skill what-is-agentpmt`) - AgentPMT account MCP/REST setup: ../agentpmt-account-mcp-rest-api-setup (ClawHub: `agentpmt-account-mcp-rest-api-setup`, page: https://clawhub.ai/agentpmt/agentpmt-account-mcp-rest-api-setup; skills.sh: `npx skills add AgentPMT/agent-skills --skill agentpmt-account-mcp-rest-api-setup`) - Marketplace product: https://www.agentpmt.com/marketplace/text-manipulation-and-converter - AgentPMT main MCP server: https://api.agentpmt.com/mcp/ - AgentPMT REST invoke endpoint: https://api.agentpmt.com/products/purchase
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 86% confidence
- Finding
The REST invoke endpoint similarly enables transmission of arbitrary user text to an external service. Because this skill's primary purpose is text processing, accidental disclosure is plausible if agents route routine text-cleaning tasks through the remote endpoint without surfacing that boundary to the user.
- Content
md - AgentPMT account MCP/REST setup: ../agentpmt-account-mcp-rest-api-setup (ClawHub: `agentpmt-account-mcp-rest-api-setup`, page: https://clawhub.ai/agentpmt/agentpmt-account-mcp-rest-api-setup; skills.sh: `npx skills add AgentPMT/agent-skills --skill agentpmt-account-mcp-rest-api-setup`) - Marketplace product: https://www.agentpmt.com/marketplace/text-manipulation-and-converter - AgentPMT main MCP server: https://api.agentpmt.com/mcp/ - AgentPMT REST invoke endpoint: https://api.agentpmt.com/products/purchase
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
This markdown file describes
normalize-whitespaceas trimming lines, removing empty lines, and collapsing spaces, which can permanently alter formatting or content structure. The description does not include any warning that the transformation is lossy or irreversible, despite the rule requiring markdown files to warn about behaviors that could affect user data integrity.- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The
remove-accentsaction strips diacritical marks, which can permanently change spelling, pronunciation, or meaning in many languages. The markdown description presents the operation without any user-facing caution about this lossy transformation affecting user data.- Content
Static analysis
No suspicious patterns detected.