agent-namer

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 9:27 PM UTC
• Version: 1.0.0

Overview

This is a small local agent-name registry skill with reliability issues, but no evidence of hidden access, network use, credential handling, or destructive behavior.

Install only if a Chinese-language internal 货xx naming registry is what you want. Treat it as a local shared-state tool: confirm the chosen name before add/kill operations, and fix the helper's missing save_used_names call and lack of format validation before relying on it operationally.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The documented behavior does not match the actual operational guarantees: the skill claims to generate compliant `货xx` names and manage the full used-name list, yet the described implementation does not enforce the format and may only list active names. This mismatch can cause operators or downstream agents to trust validation that is not actually happening, enabling inconsistent or duplicate entries to be recorded.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 86% confidence
• Finding: The skill documentation instructs the agent to read from and modify a local name registry via `python3 scripts/manage_name.py`, but it declares no explicit tool scope or permission boundaries. In an agent environment, this can lead to overbroad file access and unintended state changes because the agent may invoke file read/write capabilities without any documented authorization constraints.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: The description and overview require names to use the fixed format `货xx`, which enforces a specific language/locale convention. Under the policy, forcing a language-specific convention without user opt-in or an explicit documented justification is a natural-language policy violation.

Natural-Language Policy Violations

Medium

• Confidence: 91% confidence
• Finding: This Python file contains natural-language text exclusively in Chinese, including the module description and all CLI messages, and the description does not state that the tool is intentionally limited to Chinese-speaking users or a region-specific workflow. Under the language/locale policy rule, forcing a specific language without opt-in or justification is a policy concern.

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: The function’s documented behavior claims it adds or revives a name and saves it, but in the revival path it only mutates in-memory state and returns success without persisting. This creates a state-integrity issue: callers that trust the function contract may believe a reservation was durably recorded when it was not, allowing duplicate or inconsistent agent-name assignments after process exit or concurrent use.

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: kill_name claims the name was marked dead and saved, but it only updates the in-memory dictionary and returns a success message implying durable persistence. If another component relies on that contract, names may be reused or remain active unexpectedly after restart, causing integrity and workflow errors in the internal naming registry.

Natural-Language Policy Violations

Medium

• Confidence: 88% confidence
• Finding: The JSON values for names, status, and roles are entirely in Chinese, which indicates a fixed language choice embedded in the skill data. There is no natural-language indication in this file that users may choose another language or that the locale restriction is intentional and justified.

Missing User Warnings

Low

• Confidence: 84% confidence
• Finding: This is a markdown file, so SQP-2 applies to omissions in user-facing safety disclosures. Lines L069-L107 describe state-changing operations (`add` and `kill`) that alter the shared naming database, but there is no warning about their persistent effect or recommendation to verify the target name before changing status.

Static analysis

No suspicious patterns detected.