Echo Gate

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 8:50 AM UTC
• Version: 0.1.2

Overview

Echo Gate is a coherent local tool-gateway skill, but users should be careful with its unpinned global npm install and credential-handling commands.

Install only if you trust the `@builtbyecho/echo-gate` npm package and publisher, prefer a pinned reviewed version where possible, and avoid exposing `ECHO_GATE_ADMIN_TOKEN`, `ECHO_GATE_KEY`, or unrelated secrets during install or tool execution.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:52

Finding

Unpinned Global Installation and Execution of a Third-Party npm Package

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 52–56
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Complete Code Snippet:

bash

npm install -g @builtbyecho/echo-gate
echo-gate

Technical Analysis

The skill directs users to globally install the latest available version of @builtbyecho/echo-gate from the npm registry and then execute its command-line interface. The dependency is not pinned to an exact reviewed version, no integrity hash or lockfile is supplied, and the package implementation is absent from the audited project.

npm installation may execute package lifecycle scripts. A global installation also makes the package's executable broadly available in the user's environment. Consequently, the effective code executed by these instructions can change after this skill has been reviewed.

Although the scoped package name and referenced GitHub repository reduce typographical-squatting risk, they do not establish package integrity or reproducible installation.

Attack Path

1. An attacker compromises the npm publisher account, package release process, or a transitive dependency.
2. The attacker publishes a malicious version under @builtbyecho/echo-gate or causes malicious code to enter its dependency graph.
3. A user follows the skill's unpinned npm install -g instruction.
4. npm retrieves the currently resolved package and dependencies rather than a specifically reviewed artifact.
5. Malicious code executes through an installation lifecycle script or when the user runs echo-gate.
6. The malicious process accesses data and credentials available to the installing user, potentially including Echo Gate environment variables.

Impact Assessment

Successful exploitation could execute arbitrary code with the privileges of the user performing the installation. The affected scope may include:

• Files readable or writable by that user.
• Environmen ...[truncated 609 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the dependency to an exact reviewed version rather than installing the moving latest release:

   bash

   npm install --save-exact @builtbyecho/echo-gate@<reviewed-version>
   

2. Prefer a project-local, lockfile-backed installation over a global installation, and commit the generated lockfile.
3. Use npm ci in controlled deployments to enforce the dependency graph recorded in the lockfile.
4. Verify npm package provenance, publisher identity, signatures or attestations, and registry integrity metadata before installation.
5. Audit both the package and its transitive dependencies for lifecycle scripts and known vulnerabilities.
6. Disable lifecycle scripts during installation where operationally feasible, then explicitly execute only reviewed build steps:

   bash

   npm ci --ignore-scripts
   

7. Run installation and execution under a least-privileged account without unnecessary secrets in the environment.
8. Avoid exposing ECHO_GATE_ADMIN_TOKEN, ECHO_GATE_KEY, and unrelated credentials to package installation processes.
9. Document the expected package checksum, source revision, and supported version so users can verify that the installed artifact matches the audited release.

SkillSpector

Vulnerability Patterns

• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 38)May include surrounding context.

md

- `POST /tools`
- `POST /keys`
- `GET /keys`
- `DELETE /keys/:id`
- `PUT /keys/:id/policies/:slug`
- `POST /tools/:slug/call`
- `GET /receipts`