Agnic Get Agent Identity

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:19 AM UTC
• Version: 2.0.2

Overview

The skill does what it says, but it relies on running a mutable third-party npm CLI that may handle authentication tokens.

Review before installing. The identity-check function is narrow and disclosed, but install only if you trust the current and future Agnic npm package releases, and avoid exposing unrelated secrets in the agent environment. Prefer a pinned, reviewed CLI version and avoid passing tokens on the command line when possible.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:10

Finding

Execution of an Unpinned Third-Party npm Package

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 10-11
Vulnerability Type: Unpinned and mutable third-party dependency execution
Risk Level: Medium

yaml

allowed-tools:
  - "Bash(npx agnic@latest status*)"
  - "Bash(npx agnic@latest agent-identity*)"

The same mutable package reference is used by the documented commands at lines 20 and 28:

bash

npx agnic@latest status --json

bash

npx agnic@latest agent-identity --json

Technical Analysis

The skill authorizes and instructs the agent to execute agnic@latest through npx. The npm latest distribution tag is mutable and can resolve to a different package version each time the command is invoked. Furthermore, npx can download and execute the resolved package on demand.

Consequently, the effective executable code is not fixed to the version that was available when the skill was reviewed. The project contains no exact version pin, lockfile, integrity hash, provenance verification, or locally bundled and reviewed implementation. A compromised npm publisher account, malicious package release, or compromised transitive dependency could therefore introduce arbitrary code without any change to this repository.

Attack Path

1. An attacker compromises the npm publisher account, package distribution process, or dependency chain for agnic.
2. The attacker publishes a malicious release and causes the mutable latest tag to resolve to it.
3. A user invokes the skill to check agent identity or authentication status.
4. The agent runs one of the authorized npx agnic@latest commands.
5. npx retrieves and executes the malicious package with the privileges and environment of the invoking process.
6. The malicious release can inspect accessible environment variables, files, credentials, and network resources before returning plausible CLI output to conceal the compromise.

Impact Assessment

Successful exploitat ...[truncated 741 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace agnic@latest with an exact, reviewed package version, such as agnic@X.Y.Z.
2. Install the dependency locally using a committed lockfile with npm integrity hashes, and invoke the locked local executable rather than allowing npx to download code on demand.
3. Review package provenance and signatures where supported, and obtain packages only from the expected registry.
4. Establish a controlled update process in which new versions are reviewed and tested before changing the pin.
5. Run the CLI in a least-privilege sandbox with narrowly restricted filesystem and network access.
6. Expose only the environment variables required by the command. Keep unrelated wallet credentials, API keys, and session secrets out of the child process environment.
7. Prefer a protected secret manager or carefully scoped environment variable for authentication. Avoid passing tokens through command-line arguments because they may be exposed through process listings, shell history, or logs.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (8)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 99% confidence

Finding

The second manifest entry also authorizes npx agnic@latest, carrying the same supply-chain and arbitrary-code-execution risk. Because manifest entries govern what the agent may execute, unpinned versions here materially weaken trust boundaries for the whole skill.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

The skill permits execution of npx agnic@latest, which fetches and runs whatever package version is current at execution time. That creates a supply-chain risk: a compromised publisher account, malicious release, or breaking update could cause arbitrary code execution in the agent environment.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

This invocation again uses npx agnic@latest, meaning the code executed is not stable or reviewable at skill publication time. An attacker who can influence the npm package or its dependencies could execute arbitrary commands when the skill runs.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

The authentication check instructs the agent to run npx agnic@latest status --json, which dynamically retrieves executable code from the registry. Because this skill handles authentication state and may coexist with tokens in the environment, unpinned package execution is especially risky here.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

The login instruction references npx agnic@latest auth login, which would execute whatever current package is published. In an interactive auth flow, a malicious or compromised version could phish credentials, exfiltrate tokens, or alter login behavior.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

The primary identity lookup command uses npx agnic@latest agent-identity --json, introducing the same uncontrolled remote-code execution path into the core functionality of the skill. Since this is the main command users are expected to invoke, exploitation probability is increased by routine use.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The prerequisites section again references unpinned npx agnic@latest status, reinforcing insecure operational guidance. Even though this line is informational, it normalizes repeated execution of mutable external code and increases attack surface.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The error-handling guidance tells the operator to run npx agnic@latest auth login, repeating the same supply-chain exposure during remediation steps. Attackers often benefit from recovery and troubleshooting paths because users are more likely to follow them without scrutiny.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.