Security audit

Agentype

Security checks for vulnerabilities and agentic risk

Overview

The skill matches its local AI-usage analytics purpose, but it needs review because it can download and run an unpinned PyPI CLI while reading broad local agent-history metadata.

Install only if you are comfortable with a tool scanning local AI-agent usage metadata such as projects, models, tokens, and usage patterns. Prefer using a preinstalled or pinned, reviewed `agentype-cli` version instead of allowing the unpinned `uvx` fallback to fetch and execute the latest package at runtime.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:52
Finding: Unpinned Third-Party Package Download and Execution
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill directs collection of local AI-agent history, token metadata, top projects, models, and usage rhythm, but it does not require an explicit user-facing privacy warning or consent check before reading that data. Even if the intent is analytics, these sources can reveal sensitive project names, work patterns, model usage, and other behavioral metadata, creating privacy risk especially in shared or enterprise environments. The context makes this more dangerous because the whole purpose of the skill is to aggregate local usage data across multiple agent ecosystems.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 90% confidence
Finding: The skill instructs use of uvx --from agentype-cli agentype --json-out without pinning an exact package version. That allows the executed code to vary over time and creates a supply-chain risk where a malicious or compromised upstream release could run arbitrary code on the local machine when the skill is invoked. Because this skill is explicitly meant to inspect local agent history, it would likely run with access to sensitive local metadata, increasing the consequence of a bad package update.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.