aispace

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 12:03 AM UTC
• Version: 1.0.0

Overview

This skill is a disclosed aispace CLI integration for user-directed remote storage and encrypted transfers, with install and invocation cautions but no hidden or destructive behavior found.

Install this only if you want Codex to use aispace for remote storage or encrypted artifact exchange. Confirm before creating public links, deleting files, or sending to recipients, protect AISPACE_KEY and transfer tokens, and consider pinning or reviewing the @aispace-sh/cli package before use in sensitive environments.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:16
• Finding: Unpinned Executable npm Dependency## Vulnerability Details **File Location**: `SKILL.md`, lines 16–21 **Vulnerability Type**: Unpinned third-party executable dependency **Risk Level**: Medium ```yaml install: - kind: node package: "@aispace-sh/cli" bins: - aispace ``` ### Technical Analysis The skill installs and executes the `@aispace-sh/cli` npm package without specifying an exact version or integrity digest. Consequently, installation can resolve mutable registry content that was not part of this audit. If the package, publisher account, or dependency chain is compromised, a malicious future release could execute with the permissions of the agent process. This finding establishes supply-chain exposure, not evidence that the current package is malicious. ### Attack Path 1. An attacker compromises the npm publisher account, package, or one of its resolved dependencies. 2. The attacker publishes a malicious release that still provides the expected `aispace` binary. 3. The skill installer resolves the unpinned package to that affected release. 4. The agent invokes `aispace` for a legitimate storage or transfer operation. 5. Malicious package code executes under the agent's operating-system account and accesses resources available to that process. ### Impact Assessment Successful exploitation could expose artifacts selected for upload, environment credentials such as `AISPACE_KEY`, CLI configuration, identity or transfer records readable by the agent account, and network resources available to the process. The precise scope would be limited by the operating-system privileges, filesystem access, environment, and network permissions granted to the agent.
• Remediation: ## Remediation Suggestions - Pin `@aispace-sh/cli` to an audited, exact version rather than allowing mutable version resolution. - Enforce registry integrity verification with a trusted lockfile and package integrity hash where the skill installation framework supports them. - Verify package provenance and publisher identity before approving updates. - Review each dependency update before deployment and use automated supply-chain scanning for the package and its transitive dependencies. - Run the CLI with least privilege, exposing only the files, credentials, and network destinations required for the requested operation. - Prefer an installation mechanism that fails closed when the pinned version or expected integrity metadata does not match.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The skill description and default prompt are broad enough to match many ordinary requests involving artifacts, storage, uploads, downloads, or handoffs. Because implicit invocation is allowed, this can cause the agent to route user data into the aispace workflow when the user did not clearly request remote transfer, expanding data exposure and creating unintended side effects.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: Enabling implicit invocation without tight trigger constraints allows the skill to activate automatically for ambiguous requests. In a skill that handles secure storage, delivery, identities, and recipient trust, unintended activation can transmit artifacts, create shares, or perform remote handoff operations without sufficiently explicit user consent, increasing confidentiality and integrity risk.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

aispace transfer create report.pdf --sealed --link \
  --json --include-secret > handoff.json
jq -r .token handoff.json > handoff.token
chmod 600 handoff.token
```

`--include-secret` requires `--json` and is refused when stdout is a terminal. Keep the protected

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Static analysis

No suspicious patterns detected.