Security audit
Security checks for vulnerabilities and agentic risk
The skill is marked suspicious because scanners report unsafe handling of untrusted text and package installation commands that can run unpinned code.
Consider the command-execution, unpinned package, and hosted-content privacy concerns before installing. The verdict is suspicious, indicating reported security weaknesses without establishing malicious intent.
SKILL.mdUntrusted text is interpolated into a shell command
An external content provider can execute commands with the agent's privileges before the protective scan runs.
The workflow directs the agent to submit any external text to scan, while the cost section indicates that scanning involves hosted checks without establishing a prior privacy or consent gate. External content can still contain confidential documents, personal information or credential-bearing URLs, so this default can disclose sensitive data to a third party; the later offline option does not protect the default path.
Although this is a CLI rather than an MCP server, the underlying supply-chain finding is valid: npx -y can download and execute an unpinned package without an installation confirmation. A compromised release could execute with the agent's permissions, and the instruction to scan any external text makes this a frequently invoked trust boundary.
The verification command executes an unpinned npm package, allowing future or compromised releases to run with the agent's permissions. Its placement immediately before financial activity increases the potential impact: malicious code could steal available credentials or falsify a verification result.
The POST verification variant has the same unpinned-code execution risk; --post does not constrain which package version runs. In an x402 workflow, compromised verification code could manipulate payment decisions or access payment credentials available to its process.
The token-check command downloads and executes the package without specifying a version. Because its verdict is used before swaps or approvals, a compromised release could falsely approve a dangerous token or steal signing material if it is accessible in the execution environment.
The match is truncated: the actual fallback executes github:daoudandiaye98-alt/angel-agent-guard, not a package simply named github. With no immutable commit specified, this fallback trusts mutable repository content and may execute installation or preparation scripts, creating another code-execution supply-chain path.
This occurrence repeats the unpinned npm command as the command being replaced, rather than introducing a separate execution path. It nevertheless reinforces the vulnerable installation guidance, and the proposed GitHub fallback does not preserve an audited version boundary.