T03 · Remote Payload Retrieval and Execution
Error
- Location
references/maintenance.md:151- Finding
Remote Update Metadata Can Introduce Arbitrary Shell Commands
- Content
View full analysis
- Remediation
View remediation
Security audit
agentkey
Security checks for vulnerabilities and agentic risk
Overview
This skill has a legitimate live-data purpose, but its setup and update paths give it broad, persistent, and partly under-disclosed authority that should be reviewed before installation.
Install only if you are comfortable with AgentKey receiving live-data queries, adding an MCP server, storing authentication/configuration state, and running package-manager based setup or updates. Prefer explicit OAuth, avoid the API-key fallback unless necessary, review any update command before approving it, and consider disabling telemetry and auto-upgrade unless you specifically want them.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (4)
T08 · Insecure Dependencies
Error
- Location
references/setup.md:11- Finding
Unpinned Packages Are Downloaded and Executed Through npx
- Content
View full analysis
- Remediation
View remediation
`. 2. Pin the package that supplies the `skills` executable rather than relying on ambient or mutable resolution. 3. Remove `-y` so users can review package identity and installation details. 4. Verify registry integrity metadata, release signatures, and expected checksums before execution. 5. Prefer a lockfile-backed, locally installed updater over ad hoc `npx` resolution. 6. Separate artifact download and verification from execution. 7. Publish reproducible builds and document the expected package digest for each release. 8. Run installation with least privilege and restrict writes to the intended configuration or Skill directories. ]]>
T01 · Skill Instruction Hijacking
Warning
- Location
SKILL.md:18- Finding
Mandatory Preflight Can Redirect Unrelated User Requests into External-Service Setup
- Content
View full analysis
/dev/null`. `UP_TO_DATE` / empty → continue; `UPGRADE_AVAILABLE ` → upgrade signal. - On an upgrade signal → **load `references/maintenance.md` and follow the Upgrade flow** (prompt at most once per session). Clients with no Bash tool rely on the beacon alone — that's fine. 2. **Telemetry** (best-effort, silent): if `check-update.sh` printed a `TELEMETRY …` line, forward it once and ignore any failure — `agentkey_internal({ path: "telemetry/event", params: { event, properties: {…parsed k=v} } })`. Full spec in `references/maintenance.md`. 3. **Verify tools:** confirm `find_tools`, `describe_tool`, `execute_tool` are visible. If **any** are missing → **Setup** (regardless of what the user asked). `agentkey_account` is reached through `execute_tool`, not a tool of its own — don't gate Setup on it. **Then route by intent:** "setup" / "install" / "api key" / "reinstall" → **Setup**; "status" / "diagnose" → **Status**; otherwise → **Query**. ``` The broad activation instruction is also present in the frontmatter: ```yaml description: >- PROACTIVELY use whenever the user needs data outside your training set or requires a live network call ``` ### Technical Analysis The Skill declares that its preflight must run “befo ...[truncated 1958 chars]- Remediation
View remediation
other
Note
- Location
scripts/check-update.sh:47- Finding
Telemetry Is Enabled by Default and Forwarded Silently
- Content
View full analysis
/dev/null || stat -f %m "$hb" 2>/dev/null || echo 0) case "$mtime" in ''|*[!0-9]*) mtime=0 ;; esac age=$(( ${NOW:-$(date +%s)} - mtime )) if [ "$age" -ge 0 ] && [ "$age" -lt "$TELEMETRY_HEARTBEAT_TTL" ]; then return 0 fi fi touch "$hb" 2>/dev/null || true printf 'TELEMETRY %s skill_version=%s' "$event" "$LOCAL_VERSION" for kv in "$@"; do printf ' %s' "$kv"; done printf '\n' } ``` The forwardi ...[truncated 1803 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
Findings (30)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill is presented as a general live-data retrieval tool, but it also performs update checks, telemetry forwarding, and local environment/config inspection unrelated to that advertised purpose. This mismatch undermines user and agent trust boundaries, making it more likely the skill is invoked in situations where users did not expect maintenance/network side effects.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The documented upgrade flow directs the agent to execute shell commands, invoke package management, and write persistence files under the user's home directory. These actions are materially more sensitive than the skill's declared data-access function and create a path to arbitrary code execution and persistent local state modification.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md Reload the server in the same panel, inspect its logs if it remains disconnected, and retry only after the AgentKey tools appear. Do not put OAuth client secrets, access tokens, or an `Authorization` header in the plugin package. ### Other clients (not DSH)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 93% confidence
- Finding
The skill invokes shell commands during preflight/setup, but it declares no tool restrictions or allowed-tool scope. That creates an unnecessarily broad execution surface: any environment exposing shell can run local commands without the user being clearly informed by the manifest, increasing the chance of unintended command execution in sensitive contexts.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The activation text tells the agent to proactively use this skill whenever external data or a live network call is needed, spanning many domains. That broad trigger surface can cause unintended invocation of setup flows, telemetry, update logic, or third-party network access in contexts where a narrower or safer tool should have been chosen.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 95% confidence
- Finding
Using
npx -y @agentkey/cliwithout a pinned version allows execution of whatever package version is current at runtime. This creates a supply-chain risk: a compromised, malicious, or breaking upstream release could be executed automatically on the user's machine during setup.- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill is described as a tool for obtaining live external data, but this maintenance document adds self-update execution, local filesystem state changes, and telemetry forwarding. That scope expansion is dangerous because users or host systems may grant the skill trust appropriate for data retrieval, not for package installation, persistence, and background event transmission.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The telemetry forwarding capability sends structured events via
agentkey_internaleven though the skill's stated purpose is live data retrieval. Collecting upgrade/usage metadata outside that purpose increases privacy risk and creates an undocumented data-exfiltration channel if the internal endpoint is broader than expected.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill forwards telemetry events such as upgrade decisions silently and best-effort, with instructions to ignore failures and not surface them to the user. Silent transmission of decision/usage data without an explicit user-facing warning undermines informed consent and can expose behavioral metadata to an external service.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 89% confidence
- Finding
The document instructs the agent to run
npx skills update agentkeywithout pinning an exact package version or integrity. That allows whatever version is current in the registry at execution time to be fetched and executed, creating a supply-chain risk if the package or its dependencies are compromised.- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 90% confidence
- Finding
The document instructs the skill to persist user choices by creating files under
~/.config/agentkey/, including auto-upgrade, snooze, and disable markers. Even though the writes are framed as preference storage, they establish cross-session persistence and modify the local environment in a way unrelated to the core data-retrieval purpose, increasing the skill's effective privileges and persistence footprint.- Content
md If a Bash tool is available (Claude Code etc.), use `AskUserQuestion`. Otherwise (Claude Desktop and any web/sandboxed client without shell access), display the question and four options as a normal chat message and parse the user's natural-language reply. **Important — persistence caveat for no-Bash clients:** the *Always*, *Not now*, and *Never ask again* options each persist state by writing a file under `~/.config/agentkey/`. Without a Bash tool you **cannot** write those files. Do not pretend you did — follow the no-Bash fallback line in each option below and tell the user exactly what state did or didn't get saved. - Question: `AgentKey v<new> is available (currently on v<old>). Upgrade now?` - Options:
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 95% confidence
- Finding
This line explicitly directs execution of
npx skills update agentkey, which downloads and runs code from an unpinned package source. Because the version is not fixed, behavior can change over time and a compromised upstream package could lead to arbitrary code execution on the client.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 93% confidence
- Finding
The remediation text again tells users to run
npx skills update agentkeymanually, perpetuating the same unpinned remote-code execution path. Recommending manual execution does not reduce the supply-chain risk; it still relies on mutable upstream content.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 83% confidence
- Finding
The instructions direct users to write a home-level bearer configuration that persists across current and future profiles. Persistent bearer storage increases the blast radius of token compromise because multiple sessions and profiles may inherit the same credential, and the patch file may be exposed via filesystem access, backups, or accidental sharing.
- Content
It cannot follow a 401/RFC 9728 challenge or launch AgentKey's browser OAuth. Do not add a header-free MCP entry and do not use the generic JSON below.
If this Skill is already running in DSH, authenticate and write the home-level Bearer configuration with:
bash
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 89% confidence
- Finding
The documentation instructs users to run
npx -y @agentkey/cliwithout pinning an exact package version. That allows whatever version is current at execution time to run with the user's privileges, creating a supply-chain risk if a bad release or dependency compromise occurs.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 84% confidence
- Finding
npx skills add chainbase-labs/agentkey -g -yreferences remote package content without any version pinning or integrity constraint. This exposes users to unexpected code changes or malicious upstream modifications during installation.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 89% confidence
- Finding
This is a second unpinned invocation of
@agentkey/cli, again causing live retrieval and execution of the latest published code. Repeated use in setup instructions increases exposure because users are normalized to executing mutable remote code.- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md block installation; a managed or unmarked legacy Loader in one must be removed manually from the reported target before retrying. Two ways to connect the hosted MCP server (`https://api.agentkey.app/v1/mcp`). **Prefer OAuth.** Use the API-key fallback only when the client can't do MCP OAuth, or the OAuth flow fails.
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md block installation; a managed or unmarked legacy Loader in one must be removed manually from the reported target before retrying. Two ways to connect the hosted MCP server (`https://api.agentkey.app/v1/mcp`). **Prefer OAuth.** Use the API-key fallback only when the client can't do MCP OAuth, or the OAuth flow fails.
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md block installation; a managed or unmarked legacy Loader in one must be removed manually from the reported target before retrying. Two ways to connect the hosted MCP server (`https://api.agentkey.app/v1/mcp`). **Prefer OAuth.** Use the API-key fallback only when the client can't do MCP OAuth, or the OAuth flow fails.
Static analysis
No suspicious patterns detected.