Security audit

Cancorteaw App

Security checks for vulnerabilities and agentic risk

Overview

This skill is purpose-aligned as a local Expo app runner, but its real execution is delegated to an unreviewed host script and mutable npm tooling.

Review or control /home/patron/apps/_bin/appctl before installing, because that external script is the code that will actually run. Prefer a packaged or hash-verified runner and pinned Expo/create-expo-app versions, and run it with limited filesystem and credential access.

A.I.G

Vulnerability Patterns

Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T07 · Tool Hijacking and Spoofing

Error

Location: skill.json:3
Finding: Execution Delegated to an Unreviewed Mutable External Script
Content: View full analysis
`. ``` ### Technical Analysis The Skill uses `/home/patron/apps/_bin/appctl` as its shell entrypoint, but that executable is not included in the audited package. Therefore, the package does not define or attest to the code ultimately executed when the Skill is invoked. The security claims that the runner is allowlisted and restricted to `/home/patron/apps` cannot be verified from the supplied files. The absolute path also creates a trust dependency on the host filesystem: any party capable of creating, replacing, or modifying `appctl` can alter the effective behavior without modifying the reviewed Skill package. The use of `"{{args}}"` additionally forwards user-controlled arguments into the external runner. Command injection cannot be confirmed because neither the framework's interpolation behavior nor the runner implementation was available for review, but the missing implementation prevents validation of argument handling. ### Attack Path 1. An attacker gains write access to `/home/patron/apps/_bin/appctl` or controls that path before deployment. 2. The attacker creates or replaces `appctl` with a malicious executable. 3. A user or Agent invokes any command exposed by the Skill. 4. The shell entrypoint executes the attacker-controlled program under the permissions of ...[truncated 709 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:29
Finding: Unpinned Third-Party Package Execution Through npx
Content: View full analysis
` ``` ### Technical Analysis The documented workflow executes `create-expo-app` and `expo` through `npx` without specifying exact versions or integrity values. Depending on the environment and local installation state, `npx` can resolve and download packages from a configured registry at execution time. As a result, the code executed by the Skill can change after the Skill itself has been audited. A compromised registry account, unsafe registry configuration, dependency takeover, or unexpected upstream release could introduce malicious or incompatible code. Package installation and execution may also trigger dependency lifecycle behavior. The unavailable `appctl` implementation prevents confirmation of whether it adds version constraints, uses a lockfile, disables downloads, or performs integrity verification. This finding is therefore based on the explicitly documented commands. ### Attack Path 1. The environment lacks a trusted local installation of the required package, or its `npx` resolution selects a remote package. 2. An upstream package, transitive dependency, publishing account, or configured package registry is compromised or serves an unsafe release. 3. A user invokes `new` or `preview`. 4. The external runner invokes `npx create-expo-app` or `npx expo`. 5. `npx` retrieves or resolves the unpinned package and executes its code. 6. The compromised package runs with the permissions and access available to the Skill process. ### Impact Assessment A successful supply-chain compromise could execute arbitrary package or lifecycle code with the privileges of the Skill process. Potential s ...[truncated 355 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: Using npx create-expo-app without pinning an exact package version allows the skill to fetch and execute whatever version is current at runtime. If the upstream package, one of its transitive dependencies, or the registry response is compromised, this runner could execute unreviewed code on the host while creating a project under the trusted local apps directory.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: Using npx expo without an exact version means preview startup will resolve and execute the latest available Expo CLI code at runtime. Even though the preview binds to 127.0.0.1, the main risk is supply-chain code execution on the local machine, not network exposure; the skill's 'allowlist' does not prevent malicious behavior inside a fetched Node package.
Content: No source excerpt is available for this finding.