Agent Chat

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 4:25 PM UTC
• Version: 0.1.0

Overview

This skill is a straightforward temporary chat-room helper, with normal but important cautions about password handling and the external package it runs.

Install only if you are comfortable running the external agent-chat package with uv. Use a low-value temporary room password, avoid putting reusable secrets in command history or URLs, and prefer isolated environments for internet-exposed chat rooms.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:17

Finding

Execution of an Unpinned Third-Party Package

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 17–33
Vulnerability Type: Unpinned dependency execution
Risk Level: Medium

The documented commands execute the agent-chat package without specifying an audited version, cryptographic hash, or lockfile.

bash

uv run --with agent-chat agent-chat serve --password SECRET --tunnel cloudflared

uv run --with agent-chat agent-chat join --url https://xxx.trycloudflare.com --password SECRET --agent-name "my-agent"

uv run --with agent-chat agent-chat send --url https://xxx.trycloudflare.com --password SECRET --agent-name "my-agent" --message "hello!"

uv run --with agent-chat agent-chat listen --url https://xxx.trycloudflare.com --password SECRET

Technical Analysis

The uv run --with agent-chat invocation dynamically resolves, downloads, and executes a third-party package from the configured package index. Because no package version, artifact hash, or verified lockfile is provided, the effective code executed by these commands can change after this Skill has been reviewed.

This creates a supply-chain trust boundary outside the audited project. If the package publisher account, package registry, dependency resolution process, or a transitive dependency is compromised, following the documented instructions could execute attacker-controlled code. The audit found no evidence that the currently published package is malicious; the vulnerability is the mutable and unverified dependency execution mechanism.

Attack Path

1. An attacker compromises the agent-chat distribution channel, publisher account, package registry, or a dependency selected during resolution.
2. The attacker publishes a modified package version containing malicious installation-time or runtime behavior.
3. A user follows one of the documented uv run --with agent-chat commands.
4. uv resolves and downloads the unpinned package or affected dependency.
5. The downloaded package ...[truncated 699 chars]

Remediation

View remediation

Remediation Suggestions

• Pin agent-chat to a specific version that has been reviewed and tested.
• Use a committed lockfile with cryptographic hashes for the package and all transitive dependencies.
• Configure uv to use an explicitly trusted package registry rather than relying on ambient index configuration.
• Verify package provenance or signatures where supported.
• Periodically review pinned updates before changing the approved version.
• Run the package with least privilege, preferably in an isolated environment with restricted filesystem, credential, and network access.
• Document the expected package publisher, registry, version, and integrity information so users can verify the resolved artifact before execution.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill documentation repeatedly demonstrates passing the room password directly on the command line and in URL query parameters, which commonly exposes secrets through shell history, process listings, terminal logs, copied transcripts, browser history, reverse-proxy logs, and shared screenshots. In this skill's context, the risk is elevated because it is explicitly designed for temporary internet-exposed chat rooms and even suggests tunneling via Cloudflare, increasing the chance that users will share or log these credentials insecurely.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.