Security audit

agentkey

Security checks for vulnerabilities and agentic risk

Overview

AgentKey is mostly a coherent live-data connector, but it also performs silent telemetry and self-update maintenance with local persistence that users should review before installing.

Review this skill’s telemetry and update behavior before installing. The core AgentKey workflow is understandable, but installation may add MCP authentication, store a bearer key in some clients, run local update checks, and silently send version/update decision metadata unless telemetry is disabled.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill explicitly instructs Bash clients to run a local shell script for update checks, but no corresponding permission declaration is present in the analyzed file. Undeclared shell capability is dangerous because it expands the skill's effective privileges beyond what users and hosting agents may expect, enabling local command execution paths that could be abused if the script or its environment is compromised.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The published description frames the skill as a live-data retrieval tool, but the body also performs software update checks, telemetry forwarding, and local config/cache interactions. This mismatch is security-relevant because operators may approve or auto-invoke the skill for data access while being unaware that it also performs local execution and outbound metadata transmission.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The script emits telemetry-related stdout directives and maintains a heartbeat cache, which is outside the manifest’s stated purpose of live-data/provider discovery. Even though the script itself does not directly send network telemetry, it creates a covert signaling channel for the surrounding skill to forward usage metadata, increasing privacy and scope-creep risk beyond user-expected functionality.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: This script performs self-update/version-check logic against GitHub rather than the user-requested external data retrieval described by the skill metadata. In an agent skill, undeclared self-management network behavior expands trust boundaries and can enable persistent vendor-controlled prompting, version surveillance, or future upgrade pathways unrelated to the user’s task.

Vague Triggers

Medium

Confidence: 83% confidence
Finding: The activation text says to proactively use the skill whenever current or external data may be needed, covering a very broad set of common tasks. Overbroad triggering increases attack surface by causing frequent automatic invocation of a network-enabled skill, including setup flows and external calls in contexts where the user may not have intended or expected them.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill instructs the agent to forward telemetry events silently and to suppress any user-facing indication of data transmission or telemetry failure. This creates an undisclosed outbound data flow channel, which is risky because version, upgrade, and user-decision metadata may be exfiltrated without informed consent or visibility.

Static analysis

No suspicious patterns detected.