Augent

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 4:23 AM UTC
• Version: 1.5.2

Overview

This is a coherent local audio/video MCP skill, with disclosed local storage and file-writing behavior, but users should notice the external unpinned package install and persistent transcription memory.

Install only if you are comfortable with a local MCP server that downloads media and ML models, stores searchable transcripts under ~/.augent, writes outputs to local folders, and may use a user-created X/Twitter auth file for Spaces. Pin or verify the augent package version where possible, and use clear_memory or Obsidian graph rebuilds only when you intend those local changes.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:15

Finding

Unpinned Third-Party Package Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:15 and SKILL.md:32
Vulnerability Type: Unpinned external dependencies
Risk Level: Medium

Vulnerable Code

At SKILL.md:15:

yaml

metadata: {"openclaw":{"emoji":"🎙","os":["darwin","linux","win32"],"requires":{"bins":["augent-mcp","ffmpeg","yt-dlp","aria2c"]},"install":[{"id":"uv","kind":"uv","package":"augent","bins":["augent-mcp","augent","augent-web"],"label":"Install augent (uv)"},{"id":"pip","kind":"pip","package":"augent[all]","bins":["augent-mcp","augent","augent-web"],"label":"Install augent (pip)"}]}}

At SKILL.md:32:

text

Install via the ClawHub install button above, or use `uv tool install augent` for the base package or `uv tool install "augent[all]"` for all features. FFmpeg is required for audio processing.

Technical Analysis

The skill installs the external augent package without an exact version, cryptographic hash, signature requirement, or lockfile. Consequently, installation resolves whichever package version the configured registry currently serves. The augent[all] variant also installs an expanded transitive dependency set, increasing the supply-chain attack surface.

The artifact contains only documentation and metadata; it does not include the implementation of the installed augent-mcp, augent, or augent-web executables. Therefore, the reviewed artifact cannot establish that the downloaded package corresponds to an audited source revision or verify its runtime claims.

This is a supply-chain weakness rather than evidence that the current package is malicious. Exploitation requires compromise or malicious publication of the package or one of its dependencies.

Attack Path

1. An attacker compromises the package publisher, registry account, release process, or an unpinned transitive dependency.
2. The attacker publishes a malicious release under a version accepted by the unconstrained augent or `au ...[truncated 1083 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the package to a reviewed exact version in both installation metadata and documentation, such as augent==1.4.0, after confirming that this version matches the intended release.
2. Require cryptographic hashes for the package and all resolved dependencies where the installation mechanism supports hash verification.
3. Publish and maintain a lockfile or equivalent dependency manifest containing exact transitive versions and integrity information.
4. Generate an SBOM for the base and all installations and continuously scan all dependencies for compromised or vulnerable releases.
5. Verify that package-registry provenance, repository tags, and release artifacts correspond to the same audited source revision. Prefer signed releases and trusted publishing.
6. Separate optional features so users do not need to install the broad augent[all] dependency set unless those capabilities are required.
7. Run the MCP server with least privilege and restrict filesystem and network access to the directories and destinations necessary for its documented functions.
8. Vendor or include the auditable implementation when feasible, allowing reviewers to validate runtime behavior rather than relying solely on an externally resolved executable.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The README advertises persistent storage features like search_memory, list_memories, memory_stats, and tag, as well as a destructive clear_memory capability, but it does not warn users that transcriptions may be retained locally or that stored data can later be deleted. In a skill handling audio/video content that may contain sensitive conversations, the lack of disclosure around persistence and destructive actions increases the risk of unintentional retention or loss of user data.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The usage examples include broad prompts like searching 'everything I've ever transcribed' and acting on arbitrary URLs or files without emphasizing scope confirmation, path restrictions, or user-consent checks. In an agentic context, such examples can normalize expansive access patterns and lead an orchestrating agent to over-collect local data, process unintended sensitive media, or initiate network downloads from loosely specified requests.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The manifest exposes many powerful media, filesystem, and persistence-related commands using short, generic descriptions without any stated guardrails, parameter restrictions, or user-confirmation expectations. In an agent setting, this ambiguity increases the chance of overbroad or unintended invocation, especially for tools that download content, write files, search stored memory, or rebuild local data structures.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The manifest includes state-changing commands such as clearing stored transcriptions, modifying tags, rebuilding the knowledge graph, and writing notes/clips/TTS output, but it does not warn users or orchestrators about destructive or persistent side effects. In agent workflows, missing warnings can lead to silent data loss, unintended modification of local knowledge stores, or filesystem changes without meaningful consent.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.