Incomplete referenced artifact analysis
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md response. Use the bundled `references/extract-redux-slice.mjs` (a faithful
Security audit
tock-fpx
Security checks for vulnerabilities and agentic risk
Overview
The skill’s read-only Tock workflows fit its purpose, but its reservation example retains personal details in a predictable temporary file without privacy safeguards.
Before using authenticated reservation queries, change the example to filter the response directly or use a private temporary directory with cleanup. Approve only the Tock domain and capabilities needed, and revoke pairing when finished. Review the CLI and extension versions separately; this review covered every bundled file, not the external dependency releases.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)
Incomplete referenced artifact analysis
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | node references/extract-redux-slice.mjs app \
The reservation-history workflow saves personal account data to a temporary file without a privacy or retention warning.
Medium
- Category
- Output Handling
- Confidence
- 96% confidence
- Finding
The workflow writes the full authenticated reservation response, including patron names, email addresses, and reservation details, to a predictable /tmp path without enforcing restrictive permissions or deleting it afterward. Depending on the host's permissions and configuration, other local users or processes could read the retained data; the predictable filename also creates a potential symlink-based file overwrite risk. Accessing reservations is legitimate for this skill, but persisting the unfiltered response unnecessarily increases exposure.
- Content