Agent Justice Protocol

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 4:47 AM UTC
• Version: 0.1.1

Overview

This skill is a coherent dispute-investigation helper, with the main caution that it asks users to install an unpinned external Python package.

Install in a virtual environment or sandbox, consider pinning and verifying the Python package version before use, and pass only the dispute and provenance files needed for the investigation.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:29

Finding

Unpinned Third-Party Package Installation from PyPI

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 29-33
Vulnerability Type: Unpinned and unverifiable third-party dependency
Risk Level: Medium

Vulnerable code snippet:

markdown

## Setup

```bash
pip install agent-justice-protocol

text

### Technical Analysis

The setup instructions install `agent-justice-protocol` directly from PyPI without specifying an audited version or cryptographic integrity hash. Consequently, the package version and code executed during installation can change after this skill has been reviewed.

Python package installation may execute package-controlled build or installation logic. The installed package is also subsequently imported and given access to dispute stores and provenance-chain files. This repository contains only `SKILL.md`; it does not include the dependency's implementation, a lockfile, package hashes, or other artifacts that would allow its behavior to be verified.

This finding does not establish that the current PyPI package is malicious. It identifies a supply-chain weakness through which a compromised maintainer account, malicious future release, or compromised package distribution path could introduce hostile code.

### Attack Path

1. An attacker compromises the external package's publication account or otherwise causes a malicious release to be served under the expected package name.
2. A user follows the documented command `pip install agent-justice-protocol`.
3. Because no version or hash is specified, pip resolves and downloads the attacker-controlled release.
4. Package-controlled installation or build code executes with the privileges of the user running pip.
5. The installed package is later imported by the documented examples and receives file paths for dispute and provenance data.
6. Malicious code could read, alter, delete, or disclose files accessible to that user or falsify investigation and risk-assessment results.

### Impact As
...[truncated 775 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the dependency to an explicitly reviewed version, such as agent-justice-protocol==<audited-version>.
2. Supply a hash-locked requirements file and install with hash verification, for example:

   bash

   python3 -m pip install --require-hashes -r requirements.txt
   

3. Record hashes for every direct and transitive dependency and regenerate them only after security review.
4. Include or link to immutable, reviewable source corresponding exactly to the pinned release.
5. Install and run the package in an isolated virtual environment or container under a dedicated, least-privilege account.
6. Restrict filesystem and network access at the operating-system or sandbox level rather than relying on documentation claims.
7. Verify package provenance using signed release artifacts or trusted-publisher attestations where available.
8. Add automated dependency scanning and require review before updating the pinned version.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 138)May include surrounding context.

md

**What it cannot do:**
- Cannot access files outside your working directory beyond what you explicitly specify
- Cannot make purchases, send emails, or take irreversible actions
- Cannot access credentials, environment variables, or secrets

**License:** Apache 2.0