Agent Lifecycle Protocol

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 4:34 AM UTC
• Version: 0.1.1

Overview

This skill is a coherent lifecycle-tracking guide that writes local lifecycle records, with a normal but unpinned Python package install as the main caution.

Install this in a virtual environment and consider pinning or reviewing the `agent-lifecycle-protocol` package before use. Expect it to create or update local lifecycle JSONL records in your working directory.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:27

Finding

Unpinned Third-Party Package Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 27–31
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

markdown

## Setup

```bash
pip install agent-lifecycle-protocol

text

### Technical Analysis

The Skill directs users or agents to install `agent-lifecycle-protocol` from the default Python package index without specifying an exact version or validating an integrity hash. The dependency's source code is not included in the audited project, so its installation behavior, build hooks, imported code, and security claims cannot be verified from the available artifact.

Because no version constraint is present, the command resolves whichever release is current at installation time. A compromised maintainer account, malicious future release, or compromised distribution infrastructure could therefore change the code executed after this Skill has already been reviewed. Package installation may execute dependency-controlled build or installation logic, while subsequent imports execute package initialization and application code.

### Attack Path

1. An attacker compromises the package publication channel or causes a malicious release of `agent-lifecycle-protocol` to be published.
2. A user or autonomous agent follows the documented setup command.
3. `pip` resolves and downloads the attacker-controlled release because the Skill neither pins a reviewed version nor requires hashes.
4. Dependency-controlled installation or build logic executes during installation, where applicable.
5. The documented Python imports and lifecycle operations subsequently execute the installed package's code.
6. Malicious code operates with the permissions and accessible resources of the Python or `pip` process.

### Impact Assessment

Successful exploitation could allow arbitrary code execution with the invoking user's privileges. The resulting scope may include reading or modifying files accessible to that 
...[truncated 339 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the dependency to an explicitly reviewed version, such as agent-lifecycle-protocol==X.Y.Z.
2. Require cryptographic hashes through a locked requirements file and install with pip install --require-hashes -r requirements.txt.
3. Include or link to verifiable source corresponding exactly to the pinned release and retain the audit record for that version.
4. Review the package, its transitive dependencies, and any PEP 517 build backend or installation hooks before deployment.
5. Prefer prebuilt, verified artifacts from a controlled internal registry; restrict dependency updates to a reviewed release process.
6. Install and execute the package in a least-privileged virtual environment or sandbox with restricted filesystem, credential, and network access.
7. Update the security disclosure so its claims are scoped to a specifically audited package version and can be independently verified.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 145)May include surrounding context.

md

**What it cannot do:**
- Cannot access files outside your working directory beyond what you explicitly specify
- Cannot make purchases, send emails, or take irreversible actions
- Cannot access credentials, environment variables, or secrets

**License:** Apache 2.0