Security audit

Agnic Search for Service

Security checks for vulnerabilities and agentic risk

Overview

The skill has a coherent marketplace-search purpose, but it can run an unpinned third-party npm CLI and probe arbitrary URLs from the agent environment.

Review before installing. This skill is not shown to steal data or perform payments, but it runs a mutable npm package at invocation time and can send requests to user-supplied URLs from the agent's network environment. Prefer a version pinned to a reviewed agnic release, narrow invocation to explicit x402 marketplace searches, and restrict or confirm arbitrary URL inspection.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:10
Finding: Execution of an Unpinned Third-Party npm Package
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:51
Finding: Unrestricted URL and HTTP Method Probing
Content: View full analysis
[--json] ``` Auto-detects the correct HTTP method by trying each until it gets a 402 response, then displays price, accepted payment schemes, network, and input/output schemas. ``` ### Technical Analysis The documented `details` workflow accepts an arbitrary URL and states that the CLI tries HTTP methods until it receives a 402 response. The skill provides no requirement to validate the URL scheme, destination hostname, resolved IP address, redirect target, port, or HTTP method before making the request. If user-controlled input is passed to this command, requests originate from the agent's network context. This creates a server-side request forgery-style exposure: destinations unavailable to the external user may be reachable from the agent host. Relevant targets can include loopback services, private network ranges, link-local services, and cloud metadata endpoints. Trying multiple methods also creates a side-effect risk. Methods other than safe retrieval methods can alter state when sent to an endpoint that was not designed for x402 discovery. The audit does not establish that the CLI returns or exfiltrates sensitive response bodies, so direct data disclosure is conditional on the CLI's actual response handling. The ability to initiate requests to unrestricted destinations is nevertheless an unsafe coding and configuration practice. ### Attack Path 1. An attacker asks the agent to inspect an attacker-selected URL. 2. The selected URL points directly to an internal address or redirects to a loopback, private, link-local, metadata, or otherwise sensitive destination. 3. The skill invokes `npx agnic@latest x ...[truncated 1040 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (13)

Rp1

Medium

Category: MCP Rug Pull
Confidence: 99% confidence
Finding: A second manifest tool entry separately authorizes another npx agnic@latest command path, so it must be treated as a distinct vulnerable allowance even on the same line block. Each allowed tool widens the ways compromised upstream code can be executed by the agent.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The description explicitly says to use this skill as a fallback when no other skill matches and includes broad triggers like 'what can I do', which can cause unintended invocation. In a skill that performs network requests and executes an external CLI, overbroad routing increases the chance of unnecessary external calls, cache writes, and exposure to the unpinned-package risk above.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 98% confidence
Finding: The skill allows execution of npx agnic@latest ..., which fetches and runs the latest package version at runtime rather than a fixed trusted version. This creates a supply-chain risk: if the package or one of its dependencies is compromised, the agent could execute attacker-controlled code during normal skill use.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 98% confidence
Finding: The tool definition permits npx agnic@latest x402 details *, so each invocation may download and execute unreviewed code from the registry. In an agent context this is especially dangerous because normal user requests can trigger code execution without any explicit operator approval of version changes.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 96% confidence
Finding: Documenting and instructing the agent to use npx agnic@latest x402 reinforces runtime execution of an unpinned external package. If upstream content changes or is hijacked, the skill becomes a delivery path for arbitrary code under the agent's privileges.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 96% confidence
Finding: The search command example uses npx ... @latest, exposing users and operators to non-deterministic code execution and supply-chain compromise. Because this skill is user-invocable and intended for broad discovery workflows, the attack surface is repeatedly reachable.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 96% confidence
Finding: The details command example again relies on npx agnic@latest, which can execute newly published code without validation. Since details accepts arbitrary URLs, this combines network exposure with supply-chain risk in a frequently used inspection path.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The example command for weather search uses the latest package dynamically, making executions non-reproducible and vulnerable to registry/package compromise. The skill's marketplace-search purpose means this path is likely to be used often, amplifying exposure.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The sentiment-analysis search example repeats the same unsafe runtime package fetch pattern. Any compromise of the npm package, maintainer account, or transitive dependencies could turn routine agent activity into arbitrary code execution.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The full bazaar listing example also uses npx agnic@latest, preserving the same supply-chain execution risk. Because listing may be used as a fallback capability, it could be triggered broadly across unrelated user requests, increasing blast radius.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The endpoint-cost inspection example invokes an unpinned package at runtime, which is unsafe even though the function is read-only in intent. A malicious package update would still execute before any x402 logic, so the benign workflow does not reduce the core code-execution risk.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The repeated command reference continues normalizing execution of unpinned third-party code. Repetition across the skill increases the likelihood that deployers preserve the unsafe pattern rather than treating it as illustrative only.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The markdown explains that searching needs no authentication and that results are cached locally, but it does not clearly warn users that invoking the skill performs outbound network requests and writes marketplace data to a local cache path. This can create privacy and transparency issues, especially when the skill is user-invocable and broadly triggered.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.