Security audit

Agnic AI Gateway

Security checks for vulnerabilities and agentic risk

Overview

The skill does what it advertises, but it relies on an unpinned network-fetched CLI to handle prompts, authentication, and paid model calls, which deserves user review before installation.

Review this before installing. Use it only if you trust Agnic and are comfortable sending prompts to an external AI gateway with possible billing. Prefer a pinned, reviewed Agnic CLI version or a controlled local install, and avoid exposing broad environment secrets or sensitive prompts unless you have explicit approval.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Error

Location: SKILL.md:13
Finding: Execution of an Unpinned Third-Party npm Package
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (18)

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill lacks a clear warning that prompts, system text, and possibly attached data will be transmitted to external AI providers through the gateway. In this context, that omission can lead to unauthorized disclosure of sensitive user or workspace information because users may assume the processing is local or confined to the host assistant.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 97% confidence
Finding: A second manifest allowed-tools entry also authorizes npx agnic@latest, compounding the supply-chain exposure across both status and AI command paths. Because this is enforced capability scope, a compromised package could be invoked under normal skill operation with access to prompts, outputs, and environment context.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The description includes broad triggers like 'delegate to another LLM' and 'get a second opinion', which can cause over-invocation in contexts where users did not clearly consent to sending data to an external AI gateway. In this skill, overbroad invocation is especially risky because it can route arbitrary user content to third-party providers and incur cost.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The skill executes npx agnic@latest, which fetches and runs the newest package version at execution time rather than a reviewed, fixed version. This creates a supply-chain risk: a compromised upstream release or malicious dependency update could execute arbitrary code in the agent context with access to prompts, environment variables, and authentication tokens.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The skill executes npx agnic@latest, which fetches and runs the newest package version at execution time rather than a reviewed, fixed version. This creates a supply-chain risk: a compromised upstream release or malicious dependency update could execute arbitrary code in the agent context with access to prompts, environment variables, and authentication tokens.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: The documentation instructs use of npx agnic@latest, encouraging runtime execution of whatever package version is current at that moment. Even when only shown as an example, this normalizes unsafe execution patterns and can lead users or agents to run unreviewed code from the registry.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: This command example uses npx agnic@latest for model chat operations, meaning an unpinned package may be downloaded and executed before handling user prompts. In this skill context, that code may access sensitive prompt contents and any available Agnic authentication material.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: The example command references npx agnic@latest, exposing consumers to registry-supplied code changes outside the skill author's control. The danger is amplified because this skill is user-invocable and likely to be triggered frequently, increasing exposure to a malicious or compromised release.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: The image generation example relies on npx agnic@latest, so execution depends on the latest published package rather than a vetted build. A malicious update could run arbitrary code and exfiltrate local files, tokens, or prompts before or during image generation.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: This example instructs users to run an unpinned package through npx, creating a classic supply-chain exposure. Because the command is likely copied directly, the documentation itself becomes the delivery vector for unsafe execution practices.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: The chat example invokes npx agnic@latest for a task involving direct user prompt submission, so any compromised package could intercept or alter sensitive prompt data. In an agent environment, such code may also access environment variables such as AGNIC_TOKEN and other secrets.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: The free-model example still uses npx agnic@latest, preserving the same arbitrary-code-at-runtime risk regardless of model cost. The absence of payment does not reduce the threat of package compromise or secret exposure.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: The image generation example instructs downloading and running the latest package each time, which can execute attacker-controlled code if the upstream package or account is compromised. Since the command also writes output files, a malicious binary could misuse filesystem access in the current workspace.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: The authentication prerequisite references npx agnic@latest, so even checking status may require executing unreviewed code from the registry. This broadens the attack surface because users may run the command before they understand the trust boundary.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: The error-handling advice tells users to run npx agnic@latest auth login, again depending on an unpinned package to perform a sensitive authentication workflow. If compromised, the package could steal login tokens or redirect authentication flows.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: The troubleshooting step references npx agnic@latest ai models, carrying the same unreviewed code execution risk as the primary examples. Repetition throughout the skill increases the chance an agent or user will execute an unsafe command without scrutiny.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 65% confidence
Finding: The description states that costs are deducted from the user's USDC balance, imposing a specific payment/currency mechanism without offering alternatives or framing it as an optional, region-specific requirement. This can be read as a fixed locale/payment constraint not presented as user choice.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 80% confidence
Finding: This markdown file documents the --output <path> option as 'Save image to file' but does not warn that using the option will write data to the local filesystem or potentially overwrite an existing file. For markdown files, SQP-2 applies when descriptions omit warnings about behaviors that could affect user data or system integrity.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.