Argus

• Outcome: Review
• Latest audit: Sep 5, 2026 · 4:30 PM UTC
• Version: 1.0.0

Overview

Argus is a disclosed memory-checkpoint skill, but it needs review because it can write lasting private records and one helper can read outside an archive when given a crafted registry.

Install only from a reviewed, pinned source. Use Argus with trusted Archivum registries and clear workspace rules about what may be preserved. For inferred or automatic checkpoints, require the agent to show the exact records it will change before writing, and do not run backlink validation against registries from untrusted repositories until the path-containment issue is fixed.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: README.md:68
• Finding: Unpinned npx-Based Installation Uses Mutable Third-Party Sources## Vulnerability Details **File Location**: `README.md:68` **Vulnerability Type**: Supply-chain exposure through an unpinned package runner and mutable repository reference **Risk Level**: Medium ### Vulnerable Code ```bash npx skills add AntreasAntoniou/argus-skill ``` ### Technical Analysis The documented installation command invokes `npx` without pinning the `skills` package to a reviewed version. Depending on the local npm environment, `npx` can retrieve and execute the currently published package from the configured npm registry. The Skill source is also identified only by a mutable repository name, without an immutable commit hash, signed release, or integrity digest. Consequently, the code installed by this command can differ from the code covered by this audit. This is a supply-chain weakness rather than evidence that the current dependency or repository is malicious. Exploitation requires compromise or malicious control of the npm package, package-maintainer account, configured package registry, or referenced repository. ### Attack Path 1. An attacker compromises a maintainer account, the `skills` npm package, its dependency chain, the configured npm registry, or the referenced Skill repository. 2. The attacker publishes a modified package or changes the repository content resolved by the mutable reference. 3. A user follows the documented `npx skills add AntreasAntoniou/argus-skill` command. 4. `npx` retrieves and runs the current installer package, which then installs content not represented by the audited project snapshot. 5. Malicious installer logic or Skill content executes under the invoking user's account or is loaded by the user's Agent harness. ### Impact Assessment Exploited installation code would normally inherit the permissions of the user running `npx`. Depending on the host environment, this could permit access to that user's files, Agent configuration, environment variables, credentials av ...[truncated 348 chars]
• Remediation: ## Remediation Suggestions - Pin the package runner to an explicitly reviewed version, for example by using `npx skills@<exact-version>`. - Pin the Skill source to an immutable commit hash or cryptographically signed release rather than a mutable repository head. - Publish and document expected integrity hashes for release artifacts. - Recommend inspecting the resolved package and Skill source before installation. - Use lockfiles and registry allowlists where the installation environment supports them. - Avoid recommending elevated execution and explicitly state that the installer must run as an unprivileged user. - Provide a verified offline installation method for security-sensitive environments.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/check_backlinks.py:41
• Finding: Registry-Controlled Index and Home-Anchor Paths Can Escape Registered Archive Roots## Vulnerability Details **File Location**: `scripts/check_backlinks.py:41-68` **Vulnerability Type**: Path traversal and unrestricted local file read **Risk Level**: Medium ### Vulnerable Code ```python home_name = registry["home"] index_relative = registry.get("index", "00_meta/cross_archive_index.md") index = roots[home_name] / index_relative failures: list[str] = [] if not index.is_file(): return [f"missing home index: {index}"] index_text = index.read_text() referenced_archives: set[str] = set() for name, path in URI_PATTERN.findall(index_text): referenced_archives.add(name) target = resolve_uri(name, path, roots) if name not in roots: failures.append(f"unknown archive in index: archivum://{name}/{path}") elif target is None: failures.append( f"target escapes archive root: archivum://{name}/{path}" ) elif not target.exists(): failures.append(f"missing target: archivum://{name}/{path} -> {target}") home_uri = f"archivum://{home_name}/{index_relative}" for name, entry in registry["archives"].items(): if name == home_name: continue anchor_relative = entry.get("home_anchor") if anchor_relative: anchor = roots[name] / anchor_relative if not anchor.is_file(): failures.append(f"missing home anchor for {name}: {anchor}") elif home_uri not in anchor.read_text(): failures.append( f"home anchor for {name} does not link to {home_uri}: {anchor}" ) ``` ### Technical Analysis The registry's `index` and `home_anchor` values are described as archive-relative logical paths. However, the checker joins these values to an archive root and immediately calls `is_file()` or `read_text()` without resolving the resulting path and verifying that it remains beneath the corresponding root. A value containing `../` can therefore traverse ...[truncated 2001 chars]
• Remediation: ## Remediation Suggestions - Introduce a single helper for resolving every registry-relative path: ```python def resolve_within(root: Path, relative: str) -> Path: supplied = Path(relative) if supplied.is_absolute(): raise ValueError(f"absolute archive path is not allowed: {relative}") resolved_root = root.resolve() target = (resolved_root / supplied).resolve() if not target.is_relative_to(resolved_root): raise ValueError(f"path escapes archive root: {relative}") return target ``` - Apply this helper to both `index` and every `home_anchor` before calling `is_file()` or `read_text()`. - Perform containment checks after `resolve()` so that symlink-based escapes are rejected. - Validate registry field types and reject empty, absolute, malformed, or non-string path values. - Limit the maximum size read from index and anchor files to prevent memory exhaustion. - Handle `UnicodeError` in addition to existing filesystem and registry exceptions. - Add tests covering `../` traversal, absolute paths, symlink escapes, oversized files, and traversal through both `index` and `home_anchor`.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (4)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill invokes shell commands, reads and writes files, consults environment variables, and may interact with Git-backed workspaces, but it declares no permissions or trust boundaries. That mismatch increases the risk of over-privileged execution, accidental writes to the wrong archive, and silent access to broader local context than users expect.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 89% confidence
• Finding: The stated purpose is durable context capture, but the instructions also authorize filesystem discovery, registry/config inspection, backlink validation, and cross-archive metadata reporting. Those extra behaviors expand reconnaissance and data access beyond what the user may infer from the description, creating a risk of unintended enumeration of nearby workspaces and disclosure of archive structure.

Vague Triggers

Medium

• Confidence: 87% confidence
• Finding: The activation guidance is broad and includes triggers like 'remember,' 'close the loop,' and 'natural milestones,' which can cause the skill to run without a precise archival request. In a persistence-oriented skill, unintended invocation is risky because it can write durable records, inspect registries, and preserve sensitive state that should have remained ephemeral.

Context Leakage

High

• Category: Data Exfiltration

Content

---
name: argus
description: Preserve durable context from conversations and completed work by routing commitments, evidence, decisions, preferences, and project state to their canonical Git-backed records. Use when the user asks to archive, remember, checkpoint, capture context, update an Archivum-style workspace, or close the loop; also use at natural milestones when workspace instructions require durable-state capture.
---

# Argus

• Confidence: 90% confidence
• Finding: This skill is designed to preserve conversation-derived commitments, decisions, preferences, and project state into durable Git-backed records. Even though it says not to archive the conversation itself and to exclude secrets outside authorized stores, broad 'capture context' behavior still creates a substantial leakage risk if sensitive or unnecessary details are misclassified as durable state and written to long-lived repositories.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.