Ingestigate Investigative intelligence for AI agents

• Outcome: Review
• Latest audit: Sep 12, 2026 · 7:38 AM UTC
• Version: 1.0.9

Overview

The skill matches its investigative purpose, but it requires authenticated access and tells the agent to rely on a live remote guide that can change after review.

Install only if you trust the configured Ingestigate service endpoint and understand that the agent will use an authenticated API to access organization-scoped investigative data. Confirm the base URL comes from the vendor's credential flow, avoid unapproved endpoints, and treat the remote guide as untrusted reference material if it tries to expand scope or override safety rules.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:72

Finding

Runtime Retrieval of Untrusted Operational Instructions

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (9)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 60)May include surrounding context.

md

## Security

- **No persistent API keys.** Short-lived access tokens only (30-minute expiry). When the token expires, it is worthless.
- **Organization-scoped data isolation.** Every agent action is scoped to the user's exact permissions. No cross-organization data leakage.
- **Full audit trail.** Every action the agent takes is traceable to a specific authenticated user.
- **MFA required.** All accounts use multi-factor authentication.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 30)May include surrounding context.

md

homepage: https://ingestigate.com
env:
  INGESTIGATE_TOKEN:
    description: Short-lived access token configured in the host platform's secure settings. Expires in 30 minutes.
    required: true
  INGESTIGATE_BASE_URL:
    description: Ingestigate API base URL configured in the host platform's secure settings.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 38)May include surrounding context.

md

homepage: https://ingestigate.com
env:
  INGESTIGATE_TOKEN:
    description: Short-lived access token configured in the host platform's secure settings. Expires in 30 minutes.
    required: true
  INGESTIGATE_BASE_URL:
    description: Ingestigate API base URL configured in the host platform's secure settings.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 43)May include surrounding context.

md

homepage: https://ingestigate.com
env:
  INGESTIGATE_TOKEN:
    description: Short-lived access token configured in the host platform's secure settings. Expires in 30 minutes.
    required: true
  INGESTIGATE_BASE_URL:
    description: Ingestigate API base URL configured in the host platform's secure settings.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 7)May include surrounding context.

md

homepage: https://ingestigate.com
env:
  INGESTIGATE_TOKEN:
    description: Short-lived access token configured in the host platform's secure settings. Expires in 30 minutes.
    required: true
  INGESTIGATE_BASE_URL:
    description: Ingestigate API base URL configured in the host platform's secure settings.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 33)May include surrounding context.

md

homepage: https://ingestigate.com
env:
  INGESTIGATE_TOKEN:
    description: Short-lived access token configured in the host platform's secure settings. Expires in 30 minutes.
    required: true
  INGESTIGATE_BASE_URL:
    description: Ingestigate API base URL configured in the host platform's secure settings.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · skill.json (reported line 10)May include surrounding context.

json

homepage: https://ingestigate.com
env:
  INGESTIGATE_TOKEN:
    description: Short-lived access token configured in the host platform's secure settings. Expires in 30 minutes.
    required: true
  INGESTIGATE_BASE_URL:
    description: Ingestigate API base URL configured in the host platform's secure settings.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 29)May include surrounding context.

md

## Authentication

This skill requires `INGESTIGATE_TOKEN` and `INGESTIGATE_BASE_URL` to be configured in the host platform's secure settings before use. Do not ask the user to paste credentials or secrets into chat.

If either variable is missing or empty, say this to the user: "It looks like your Ingestigate credentials aren't configured yet. Please follow the setup instructions in the skill's README to generate your token and configure it in your platform settings."

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 111)May include surrounding context.

md

## Authentication

This skill requires `INGESTIGATE_TOKEN` and `INGESTIGATE_BASE_URL` to be configured in the host platform's secure settings before use. Do not ask the user to paste credentials or secrets into chat.

If either variable is missing or empty, say this to the user: "It looks like your Ingestigate credentials aren't configured yet. Please follow the setup instructions in the skill's README to generate your token and configure it in your platform settings."