Agent Wormhole

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:48 AM UTC
• Version: 0.1.2

Overview

The skill is coherent, but it asks users to run an unpinned external npm package for workflows involving secrets, files, and paid wallet-backed opens.

Review before installing or using this skill with secrets, private artifacts, or wallet/payment configs. Prefer a pinned, reviewed package version in an isolated project with only the needed files and environment variables exposed, and treat Bankr x402 commands as real paid operations even when a max payment is shown.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:31

Finding

Unpinned Third-Party Package Download and Execution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 31
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code Snippet:

bash

npx @builtbyecho/agent-wormhole send --text "mission brief"

Technical Analysis

The documented one-off command invokes an npm package without specifying an exact version or integrity constraint. Depending on the local npm environment and cache state, npx may retrieve the package currently published under @builtbyecho/agent-wormhole and execute its command-line entry point immediately.

Because the package implementation and a dependency lockfile are not included in the audited project, the downloaded code and its transitive dependencies cannot be verified by this audit. The effective behavior of the command may change after review if the publisher releases a new version or if the publisher account, package, or dependency chain is compromised.

Attack Path

1. An attacker compromises the npm publisher account, package release process, or a relevant dependency.
2. The attacker publishes a malicious version under the referenced package name or introduces malicious code into its dependency chain.
3. A user follows the documented unversioned npx command.
4. npx retrieves and executes the uncontrolled package version.
5. The malicious package runs with the invoking user's permissions and may access command input, environment variables, credentials available to the process, and files accessible to that user.

Impact Assessment

Successful exploitation could result in arbitrary code execution with the privileges of the user running npx. The accessible scope may include local project files, the submitted mission brief, user-readable configuration and credential files, and environment-based secrets. It does not inherently grant administrative privileges unless the command is run from an already privileged account or a separate escalat ...[truncated 31 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the package to an audited exact version rather than relying on the current registry release:

  bash

  npm exec --package=@builtbyecho/agent-wormhole@<exact-version> -- agent-wormhole send --text "mission brief"
  

• Verify the selected release's provenance, publisher identity, and integrity before recommending execution.

• Maintain and review a lockfile where the package is installed as a project dependency, including its transitive dependency resolutions.

• Prefer installing the reviewed version in a controlled project environment and invoking the locally installed binary.

• Use an isolated, least-privileged environment for processing sensitive handoffs, and expose only the files and environment variables required for the operation.

• Establish a dependency update process that requires security review before changing the pinned version.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The skill instructs users to execute npx @builtbyecho/agent-wormhole without pinning an exact package version. Because npx fetches and runs the latest published package at execution time, a compromised publisher account, malicious new release, or dependency-chain attack could cause arbitrary code execution on the user's machine. In this skill's context, the risk is elevated because the tool handles secrets, artifacts, and agent handoffs, so compromise could expose sensitive payloads as well as execute code.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 75)May include surrounding context.

For live health:

bash

curl -sS https://storage.builtbyecho.xyz/agent-wormhole/health

For Bankr status, check both registry and execution: