Security audit

FieldFix

Security checks for vulnerabilities and agentic risk

Overview

The skill is not malicious, but it should be reviewed because it can immediately change fleet service, expense, and hour-meter records using your FieldFix API key.

Install only if you trust FieldFix with this API key and are comfortable with an agent being able to create or update fleet records. Prefer a limited-scope API key if FieldFix supports one, and require the agent to preview and get explicit confirmation before running log-service, log-expense, or update-hours.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (12)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 35)May include surrounding context.
md
node scripts/fieldfix.js machines

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 40)May include surrounding context.
md
node scripts/fieldfix.js machines

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 45)May include surrounding context.
md
node scripts/fieldfix.js machines

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 50)May include surrounding context.
md
node scripts/fieldfix.js machines

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 55)May include surrounding context.
md
node scripts/fieldfix.js machines

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 62)May include surrounding context.
md
node scripts/fieldfix.js machines

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 67)May include surrounding context.
md
node scripts/fieldfix.js machines

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 72)May include surrounding context.
md
node scripts/fieldfix.js machines

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill advertises use of an API key via environment variable and remote API access, but it declares no explicit tool scope or permission boundaries. That makes it easier for an agent runtime to grant broader-than-necessary access to environment data and network actions, increasing the risk of secret exposure or unintended outbound requests if the skill or its implementation is ever misused.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The documentation includes state-changing operations like logging service, logging expenses, and updating hour meters, but provides no warning, confirmation, or approval guidance before performing those actions. In an agent setting, this can lead to unauthorized or mistaken record changes, corrupt maintenance history, or fraudulent expense entries if the model acts on ambiguous user input.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The CLI includes state-changing operations (log-service, log-expense, and update-hours) that execute immediately with the user's API key and no confirmation, dry-run, or explicit warning. In an agent or automation context, a mistaken invocation, prompt-influenced action, or malformed parameter can silently modify fleet records, maintenance logs, expenses, or hour meters, causing integrity and operational issues.
Content: No source excerpt is available for this finding.

Vague Triggers

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: This manifest file says the skill can 'Query and manage your heavy equipment fleet' but does not specify what phrases, contexts, or constraints should activate the skill. In a manifest, such broad capability language can contribute to ambiguous invocation scope if used by a dispatcher or router.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: scripts/fieldfix.js:22