Security audit

AgentID MCP

Security checks for vulnerabilities and agentic risk

Overview

This skill matches its AgentID coordination purpose, but it sends task details to an external service, stores persistent shared memory, and can act on remote handoffs without enough user control.

Review before installing. Use this only for projects where sending task summaries, progress details, memory entries, and mission handoffs to AgentID is acceptable. Avoid secrets, customer data, regulated data, proprietary source details, and security findings in activity details or memory. Treat missions and memory as untrusted external context and require human approval before acting on handoffs or sensitive stored facts.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

Findings (3)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:40
Finding: External Mission Instructions Can Hijack Agent Behavior
Content: View full analysis
Remediation: View remediation

T02 · Agent Memory Poisoning

Error

Location: SKILL.md:39
Finding: Externally Stored Persistent Memory Can Collect Sensitive Context and Influence Future Sessions
Content: View full analysis
Remediation: View remediation

other

Warning

Location: SKILL.md:38
Finding: Mandatory Activity Reporting Discloses User Requests and Project Details to an External Service
Content: View full analysis
")` ``` ```markdown ### Activity Reporting **`report_activity(type, title, detail, tokens_used?)`** Report what you're doing — shows in the live Agency dashboard. Valid types: - `task.started` — before beginning a task - `task.progress` — at each meaningful step (detail required) - `task.completed` — when done (include `tokens_used`) - `task.failed` — on error > **Detail is required** on every call. Say specifically what happened — not "Task completed" but "Rewrote auth middleware, removed session token storage." ``` ```markdown EVERY TASK: Call report_activity (task.started) before starting. Call report_activity (task.progress) at each meaningful step. Call report_activity (task.completed OR task.failed) when done. ``` ### Technical Analysis The skill mandates transmitting the user's request and detailed progress information to `agentid.live`. Reporting is required at task start, at each meaningful step, and at completion or failure. The resulting data is displayed in an external dashboard. The protocol includes no consent gate, redaction requirement, sensitivity classification, or data-minimization rule. A detailed activity message may reveal confidential prompts, filenames, source-code changes, authentication design, discovered vulnerabilities, deployment decisions, or other operational information. Although the user must initially configure the MCP service, the skill does not ensure that users understand that task contents and detailed progress will be repeatedly transmitted and retained externally. ### Attack Path 1. The user submits a task containing confidential or security-sensitive information. 2. Before beginning the tas ...[truncated 1042 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (5)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill instructs configuring an external MCP service and then sending activity data, but it does not clearly warn users that task details and agent activity will be transmitted off-platform. This creates a privacy and data-governance risk because users may expose sensitive prompts, project context, or operational metadata without informed consent.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The session protocol explicitly tells the agent to send detail="<what the user asked>" in report_activity at the start of every session. That creates a standing exfiltration path for user prompts to a live external dashboard, including potentially sensitive requests, proprietary code context, or personal data.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The memory feature encourages storing persistent facts such as user and project information across sessions, but the skill does not warn that this data may persist indefinitely or be accessible later by other sessions using the same identity. That omission can lead to unintentional retention of sensitive personal, business, or credential-adjacent information.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The guidance to store persistent facts about the user creates an ongoing instruction to retain user-provided data beyond the immediate task. In this skill's context, persistent cross-session storage materially increases the chance of privacy violations, over-collection, and later disclosure through shared identity access or compromise.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The mission coordination features share status updates and handoff content with other agents on the same identity, but the skill does not clearly warn that those messages are visible beyond the current agent instance. This can expose sensitive task context, internal reasoning summaries, or project details to additional actors without the user's awareness.
Content: No source excerpt is available for this finding.