Deepagents Implementation

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 8:19 AM UTC
• Version: 1.0.1

Overview

This is a documentation-style skill for building Deep Agents; it discusses powerful options like disk access, persistence, MCP subprocesses, and tokens, but those behaviors are disclosed and purpose-aligned rather than hidden or automatic.

Installers should treat this as a powerful implementation reference: use it when you intend to build Deep Agents, but pin MCP packages, avoid copying `npx -y` examples unchanged, sandbox filesystem and shell access, scope `root_dir` narrowly, require approval for writes/deletes/external actions, and use short-lived least-privilege credentials.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:457

Finding

Unpinned MCP Packages Executed Automatically Through npx

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:457-466
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

python

async def main():
    mcp_client = MultiServerMCPClient({
        "filesystem": {
            "command": "npx",
            "args": ["-y", "@modelcontextprotocol/server-filesystem", "/path"],
        },
        "github": {
            "command": "npx",
            "args": ["-y", "@modelcontextprotocol/server-github"],
            "env": {"GITHUB_TOKEN": os.environ["GITHUB_TOKEN"]},
        },
    })

Technical Analysis

The example runs two third-party packages through npx -y without pinning either package to an exact reviewed version. The -y option suppresses the installation confirmation, while the absence of a version selector permits the package resolved by the registry at execution time to differ from the package available when the Skill was reviewed.

This creates a supply-chain execution boundary: package installation and execution occur dynamically, and the effective code is controlled by mutable external registry content. If a package or its publishing account is compromised, a malicious release could execute with the permissions and environment of the Agent process.

The GitHub MCP subprocess receives GITHUB_TOKEN, and the filesystem MCP subprocess receives access to the configured path. Consequently, compromise of these dependencies could expose sensitive credentials or files. The implementation gate at SKILL.md:487 advises validating commands, arguments, environment keys, and credential handling, but it does not require exact dependency pinning, lockfile enforcement, or integrity verification.

Attack Path

1. An attacker compromises a referenced package, its maintainer account, or its dependency chain and publishes a malicious release.
2. A user implements the documented MCP configuration without adding an exact package version.
3. npx -y resolves and downloads the mutable packag ...[truncated 1091 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin each MCP package to an exact, reviewed version rather than relying on the registry's current resolution, for example:

   python

   "args": [
       "-y",
       "@modelcontextprotocol/server-filesystem@REVIEWED_EXACT_VERSION",
       "/path",
   ]
   

2. Prefer installing reviewed dependencies during a controlled build phase and executing the locally installed binaries with automatic runtime installation disabled.

3. Commit and enforce a lockfile, and verify package integrity and provenance in CI before deployment.

4. Run MCP servers in an isolated container or sandbox with restricted filesystem, network, and operating-system permissions.

5. Scope the filesystem server to the smallest required directory and avoid exposing home directories or filesystem roots.

6. Supply a short-lived, least-privilege GitHub token restricted to only the required repositories and operations. Do not reuse broadly privileged personal access tokens.

7. Restrict subprocess environment variables so each MCP server receives only the secrets it requires.

8. Add dependency scanning, release review, and controlled update procedures for MCP packages and their transitive dependencies.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 323)May include surrounding context.

md

interrupt_on={
        "send_email": True,      # Simple interrupt
        "delete_file": True,     # Require approval before delete
        # web_search not listed - runs without approval
    },
    checkpointer=checkpointer,   # Required for interrupts
)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The example explicitly instructs the agent to save and later retrieve information from persistent memory, but it does not mention consent, retention limits, or avoiding storage of sensitive data. In an agent-building reference, this can normalize deploying memory features that retain user data without adequate privacy notice or safeguards.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The example configures a FilesystemBackend rooted at a real project directory and states the agent can read/write real files and execute shell commands, but it provides no warning about destructive changes, secret exposure, or the need for sandboxing. In documentation for agent implementation, this can lead users to grant powerful local access without guardrails, increasing the risk of file tampering or compromise of the developer environment.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This markdown file documents write_file, edit_file, and execute as available tools, but it does not warn that these operations can modify files or run shell commands that affect system state. For markdown files, SQP-2 applies when descriptions omit warnings about behaviors that could affect user data or system integrity.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The example injects {"language": "en"} into user preferences, which can steer behavior toward a specific language by default. Because this is presented as example configuration without offering a user choice or documenting a justified locale constraint, it may violate language/locale policy guidance.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.