Aident Skill

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:59 AM UTC
• Version: 0.4.0

Overview

This skill is not clearly malicious, but it asks agents to install and operate broad third-party integrations through mutable remote setup instructions, unpinned packages, and risky token-handling scripts.

Review this skill before installing. It is intended to control connected work apps, so only use it with accounts you are comfortable delegating to an agent, avoid running the included REST test scripts with real tokens unless you trust the endpoint, and prefer pinned, reviewed install and MCP commands over floating npx or mutable remote setup instructions.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (5)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:31

Finding

Mutable Remote Setup Instructions Create a Post-Review Execution Channel

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Error

• Location: references/mcp.md:43

Finding

Unpinned Packages Are Downloaded and Executed Through npx

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: examples/curl/capability-search.sh:1

Finding

Bearer Token Can Be Forwarded to an Arbitrary or Plaintext Endpoint

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/test-rest-api.sh:55

Finding

OAuth Access Token Is Persisted Without Enforcing Restrictive File Permissions

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/test-rest-api.sh:55

Finding

Externally Controlled Values Are Interpolated Directly into Python Source Code

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (60)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.

md

Do not create, edit, scaffold, validate, or inspect a local `SKILL.md` file unless the user explicitly asks to author a local skill.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 74)May include surrounding context.

md

Do not create, edit, scaffold, validate, or inspect a local `SKILL.md` file unless the user explicitly asks to author a local skill.

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · examples/curl/capability-search.sh (reported line 8)May include surrounding context.

sh

BASE_URL="${AIDENT_BASE_URL:-https://app.aident.ai}"
QUERY="${1:-send email}"

curl -s -X POST "$BASE_URL/api/openapi/loadout/loadout_capabilities_search" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $AIDENT_TOKEN" \
  -d "{ \"query\": \"$QUERY\", \"limit\": 5 }" | python3 -m json.tool

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · examples/curl/skill-execute.sh (reported line 9)May include surrounding context.

sh

CAPABILITY_NAME="${1:?Usage: ./skill-execute.sh <capability_name> <input_json>}"
INPUT_JSON="${2:?Usage: ./skill-execute.sh <capability_name> <input_json>}"

curl -s -X POST "$BASE_URL/api/openapi/loadout/loadout_capabilities_execute" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $AIDENT_TOKEN" \
  -d "{

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · examples/curl/vault-status.sh (reported line 7)May include surrounding context.

sh

BASE_URL="${AIDENT_BASE_URL:-https://app.aident.ai}"

curl -s -X POST "$BASE_URL/api/openapi/loadout/loadout_vault_status" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $AIDENT_TOKEN" \
  -d '{}' | python3 -m json.tool

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/api.md (reported line 21)May include surrounding context.

md

## Getting A Token

Tokens are persisted to `~/.aident/credentials.json` after `aident login`. For direct HTTPS scripts, export the access token as `AIDENT_TOKEN`.

OAuth endpoints remain under the MCP OAuth namespace because MCP and OpenAPI use the same Aident OAuth server:

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/troubleshooting.md (reported line 34)May include surrounding context.

md

## Getting A Token

Tokens are persisted to `~/.aident/credentials.json` after `aident login`. For direct HTTPS scripts, export the access token as `AIDENT_TOKEN`.

OAuth endpoints remain under the MCP OAuth namespace because MCP and OpenAPI use the same Aident OAuth server:

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 90% confidence

Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · references/mcp.md (reported line 108)May include surrounding context.

Gemini CLI

Add to ~/.gemini/settings.json:

json

{

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/troubleshooting.md (reported line 37)May include surrounding context.

Your access token has expired (1 hour TTL). If you have a credential file, delete it and re-authenticate:

bash

rm ~/.aident/credentials.json

The agent will automatically initiate a new OOB flow on the next request.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/troubleshooting.md (reported line 69)May include surrounding context.

Your access token has expired (1 hour TTL). If you have a credential file, delete it and re-authenticate:

bash

rm ~/.aident/credentials.json

The agent will automatically initiate a new OOB flow on the next request.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 72% confidence

Finding

The instruction to verify that the file contains base_url, client_id, and access_token encourages manual inspection of a sensitive credential store. Even though intended for troubleshooting, telling users to inspect token-bearing files can lead to accidental disclosure through screenshots, copy/paste into support tickets, or exposure in insecure environments.

Content

Scanner excerpt · references/troubleshooting.md (reported line 78)May include surrounding context.

ls -la ~/.aident/credentials.json

text

The file should be readable by your user. If not: `chmod 600 ~/.aident/credentials.json`.

**Verify contents:**
The file should contain `base_url`, `client_id`, and `access_token`. If any field is empty or the JSON is malformed, delete the file and re-authenticate.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/api.md (reported line 21)May include surrounding context.

md

# Test OpenAPI package API and OOB OAuth flow
# Usage: ./aident-skill/scripts/test-rest-api.sh [BASE_URL]
#
# Credentials are saved to ~/.aident/credentials.json so you only need
# to authenticate once. Delete that file to force re-authentication.

set -euo pipefail

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/troubleshooting.md (reported line 37)May include surrounding context.

md

# Test OpenAPI package API and OOB OAuth flow
# Usage: ./aident-skill/scripts/test-rest-api.sh [BASE_URL]
#
# Credentials are saved to ~/.aident/credentials.json so you only need
# to authenticate once. Delete that file to force re-authentication.

set -euo pipefail

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/troubleshooting.md (reported line 64)May include surrounding context.

md

# Test OpenAPI package API and OOB OAuth flow
# Usage: ./aident-skill/scripts/test-rest-api.sh [BASE_URL]
#
# Credentials are saved to ~/.aident/credentials.json so you only need
# to authenticate once. Delete that file to force re-authentication.

set -euo pipefail

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/troubleshooting.md (reported line 69)May include surrounding context.

md

# Test OpenAPI package API and OOB OAuth flow
# Usage: ./aident-skill/scripts/test-rest-api.sh [BASE_URL]
#
# Credentials are saved to ~/.aident/credentials.json so you only need
# to authenticate once. Delete that file to force re-authentication.

set -euo pipefail

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/troubleshooting.md (reported line 75)May include surrounding context.

md

# Test OpenAPI package API and OOB OAuth flow
# Usage: ./aident-skill/scripts/test-rest-api.sh [BASE_URL]
#
# Credentials are saved to ~/.aident/credentials.json so you only need
# to authenticate once. Delete that file to force re-authentication.

set -euo pipefail

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/test-rest-api.sh (reported line 5)May include surrounding context.

sh

# Test OpenAPI package API and OOB OAuth flow
# Usage: ./aident-skill/scripts/test-rest-api.sh [BASE_URL]
#
# Credentials are saved to ~/.aident/credentials.json so you only need
# to authenticate once. Delete that file to force re-authentication.

set -euo pipefail

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/test-rest-api.sh (reported line 10)May include surrounding context.

sh

# Test OpenAPI package API and OOB OAuth flow
# Usage: ./aident-skill/scripts/test-rest-api.sh [BASE_URL]
#
# Credentials are saved to ~/.aident/credentials.json so you only need
# to authenticate once. Delete that file to force re-authentication.

set -euo pipefail

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/test-rest-api.sh (reported line 135)May include surrounding context.

sh

echo "  1. Log in if prompted"
  echo "  2. Click 'Approve'"
  echo "  3. Copy the access token from the OOB page"
  echo ""
  read -rp "  Paste your access token here: " ACCESS_TOKEN

Credential Access

High

• Category: Privilege Escalation
• Confidence: 81% confidence

Finding

The script reads the access token interactively using read without suppressing terminal echo, so the bearer token may be visible on screen and captured in screen recordings, shoulder surfing, terminal logging, or shared-session tooling. In combination with later disk persistence, this increases the chance of credential compromise.

Content

Scanner excerpt · scripts/test-rest-api.sh (reported line 137)May include surrounding context.

sh

echo "  2. Click 'Approve'"
  echo "  3. Copy the access token from the OOB page"
  echo ""
  read -rp "  Paste your access token here: " ACCESS_TOKEN

  if [ -z "$ACCESS_TOKEN" ]; then
    red "No token provided. Aborting."

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The README instructs agents to authenticate with external services and gives an example of sending email through connected accounts, but it does not clearly warn that these actions can cause real-world side effects or expose user data to third-party integrations. In an agent-skill context, this omission is risky because users or downstream agents may treat the examples as routine operations without explicit confirmation, increasing the chance of unintended external actions.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill instructs the agent to fetch remote content, run shell commands via npx, and potentially modify local state during setup/update flows, but it does not declare any explicit tool scope such as allowed tools or permissions. This increases the risk of overbroad execution in hosts that rely on manifest-scoped restrictions, making accidental or unsafe command/network use harder to constrain.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The skill tells the agent to install or update using npx skills add aident-ai/aident-skill without pinning a package version or commit. This creates a supply-chain risk because future upstream changes could alter behavior or introduce malicious code, and the agent is explicitly instructed to execute that remote package during setup.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The install command npx skills add aident-ai/aident-skill is presented as the package installation method without any version pinning. In a skill that already directs agents to fetch remote setup instructions, unpinned execution materially increases the attack surface for dependency or publisher compromise.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/test-rest-api.sh:223