A2A-Code-Audit

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:05 AM UTC
• Version: 1.0.0

Overview

This appears to be a real code-audit service, but it sends submitted source code to an external paid endpoint without enough privacy, scoping, or reliability safeguards.

Review before installing or invoking this skill on private repositories. Only submit code you are authorized to send to the listed external service, remove secrets first, and do not treat a clean confidence score as a strong security gate unless the service is hardened for privacy, deterministic dependencies, verified payment, reliable scanner failure handling, and safe temporary-file cleanup.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (5)

T09 · Insecure Skill Coding Practices

Error

• Location: skill.md:3

Finding

Unredacted Source Code and Embedded Secrets May Be Submitted to a Third-Party Service

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: index.js:12

Finding

Payment Authorization Can Be Bypassed with Any Nonempty Attacker-Controlled Value

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: audit.js:13

Finding

Sensitive Temporary Source Files Are Not Reliably Deleted

Content

View full analysis

.py`. 3. Bandit exits nonzero, times out, or another operation throws. 4. Execution jumps to the catch block. 5. The temporary file is not deleted. 6. A local process or administrator with sufficient filesystem access may retrieve the residual source. ### Impact Assessment The issue can expose the entire submitted source to other principals that can access the temporary file or underlying storage. No direct remote privilege escalation is demonstrated, but disclosure may include credentials whose independent permissions could enable broader com ...[truncated 12 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: audit.js:13

Finding

Bandit Failures and Finding Exit Statuses Can Produce False-Clean Audit Results

Content

View full analysis

({ line: r.line_number, issue: r.issue_text, severity: r.issue_severity.toUpperCase(), confidence: r.issue_confidence.toUpperCase(), testId: r.test_id })); } } // Add basic analysis for all languages const basicIssues = basicAnalysis(code); results.issues = [...results.issues, ...basicIssues]; ``` ```javascript const highCount = results.issues.filter(i => i.severity === 'HIGH').length; const medCount = results.issues.filter(i => i.severity === 'MEDIUM').length; const score = Math.max(0, 100 - (highCount * 10) - (medCount * 3)); results.confidenceScore = score; results.priceCents = PRICE_CENTS; ``` ### Technical Analysis `execSync` throws whenever the child process exits with a nonzero status. Security scanners can use nonzero statuses to indicate findings, not only execution failure. The broad catch converts every exception into `{ issues: [], skipped: 'bandit_unavailable' }`. The caller does not propagate the `skipped` state. It proceeds with limited regex checks and ...[truncated 990 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: package.json:6

Finding

Unused and Loosely Pinned Production Dependencies Expand Supply-Chain Exposure

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (10)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger list includes very generic phrases such as 'code review' and 'security scan', which are likely to overlap with normal user requests and other skills. This can cause the skill to activate unexpectedly or too often, potentially routing sensitive code-review or security-analysis requests to a paid third-party service without clear user intent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill invokes external commands via execSync without any disclosure or isolation controls, including running bandit against user-provided content. While the command string here is not directly built from user input, spawning subprocesses expands the attack surface and may execute attacker-influenced tooling from PATH or process untrusted files in a less controlled environment.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The function writes user-supplied source code to a predictable file under /tmp before scanning it. This can expose sensitive code to other local users or processes on the same host, and the file may persist if an error occurs before cleanup, increasing confidentiality risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill explicitly instructs users to send source code to a third-party remote endpoint, but it does not disclose any privacy, retention, logging, training, or data-handling practices. Because source code commonly contains proprietary logic, credentials, internal URLs, or embedded secrets, users may unintentionally exfiltrate sensitive material to an external service without informed consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The /audit handler accepts arbitrary source code from the request body and passes it into the audit routine, meaning user code is transmitted to and processed by this service. In this code file there is no confirmation prompt, user-facing warning, or explanatory comment/docstring near the endpoint indicating that submitted code leaves the user context and is analyzed server-side.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 96% confidence

Finding

The dependency uses a caret range instead of an exact pinned version, which allows npm to resolve newer minor or patch releases over time. This creates supply-chain and reproducibility risk because different installations may pull different code, including a vulnerable or malicious upstream release.

Content

Scanner excerpt · package.json (reported line 11)May include surrounding context.

json

"audit": "node audit.js"
  },
  "dependencies": {
    "express": "^4.18.2",
    "bandit": "^1.7.6",
    "eslint": "^8.57.0",
    "python-shell": "^5.0.0"

Unverifiable Dependency: express has 5 known advisory(ies) (CVE-2024-10491 (Express ressource injection); CVE-2014-6393 (No Charset in Content-Type Header in express); CVE-2024-9266 (Express Open Redirect vulnerability) +2 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 71% confidence

Finding

The manifest references express with a non-exact version, and known advisories exist for some express releases. Because the version is not pinned, it is not possible to verify from this file alone whether installations will resolve to an affected version, so the project carries uncertainty and potential exposure.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

Using an unpinned version for bandit means the installed package may change between environments or over time without explicit review. Even for tooling, this can introduce unexpected vulnerable code or compromised package updates into the build or audit workflow.

Content

Scanner excerpt · package.json (reported line 12)May include surrounding context.

json

},
  "dependencies": {
    "express": "^4.18.2",
    "bandit": "^1.7.6",
    "eslint": "^8.57.0",
    "python-shell": "^5.0.0"
  }

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

The eslint dependency is not strictly pinned, so builds may consume different package contents across installations. This weakens build integrity and can expose the project to supply-chain issues if a later allowed release contains a vulnerability or malicious change.

Content

Scanner excerpt · package.json (reported line 13)May include surrounding context.

json

"dependencies": {
    "express": "^4.18.2",
    "bandit": "^1.7.6",
    "eslint": "^8.57.0",
    "python-shell": "^5.0.0"
  }
}

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 96% confidence

Finding

The python-shell package is allowed to float within the caret range, which can silently introduce behavioral changes or vulnerable code. Because this package bridges Node.js and Python execution, supply-chain uncertainty around it is somewhat more sensitive than a purely passive library.

Content

Scanner excerpt · package.json (reported line 14)May include surrounding context.

json

"express": "^4.18.2",
    "bandit": "^1.7.6",
    "eslint": "^8.57.0",
    "python-shell": "^5.0.0"
  }
}