agentic-route

• Outcome: Review
• Latest audit: Sep 11, 2026 · 7:47 AM UTC
• Version: 0.1.0

Overview

This skill is aimed at network routing operations, but it exposes disruptive routing, bypass, interception, packet-capture, database, REST API, and MCP actions without enough scoping or safety controls.

Review this carefully before installing. Only use it in an environment where you intentionally want an agent to inspect and modify DNS/routing behavior, and prefer a verified absolute executable path, a pinned trusted install, least-privileged execution, explicit confirmations for mutating commands, and documented rollback procedures.

A.I.G

Vulnerability Patterns

• Tool Hijacking and Spoofing: Modifies or replaces tools so legitimate-looking calls execute attacker logic
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T07 · Tool Hijacking and Spoofing

Warning

• Location: SKILL.md:46

Finding

PATH-Based Executable Spoofing in MCP Configuration

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 46-51
Vulnerability Type: Unverified PATH-resolved executable invocation
Risk Level: Medium

The documented MCP configuration invokes agentic-route using a bare executable name:

json

{
  "mcpServers": {
    "agentic-route": {
      "command": "agentic-route",
      "args": ["mcp"]
    }
  }
}

Technical Analysis

The MCP host resolves the agentic-route command through the process environment's PATH. The project contains only SKILL.md and does not include the referenced executable, a trusted installation source, a pinned version, an integrity checksum, or a verified absolute path.

Consequently, the MCP configuration cannot ensure that the program it launches is the intended implementation. An attacker who can place or replace an executable named agentic-route in a directory searched before the legitimate installation can cause the MCP host to execute attacker-controlled code.

This is a tool-spoofing risk rather than evidence that this package itself contains malicious executable code. The actual behavior of the advertised Bash/Rust engine also cannot be audited because its implementation is absent.

Attack Path

1. A user or administrator copies the documented MCP configuration into an Agent or MCP host configuration.
2. An attacker gains write access to a directory that appears early in the MCP host's PATH, or influences the environment used to launch that host.
3. The attacker places a malicious executable named agentic-route in that directory.
4. The MCP host processes the configuration and resolves the bare agentic-route command through PATH.
5. The malicious executable is launched with the mcp argument.
6. The executable runs with the operating-system privileges and environment access of the MCP host process.

Impact Assessment

Successful exploitation permits arbitrary code execution under the ...[truncated 546 chars]

Remediation

View remediation

Remediation Suggestions

1. Distribute the actual agentic-route implementation through a documented and authenticated installation channel.
2. Pin the installed release to a reviewed version and publish a cryptographic checksum or signed release artifact.
3. Configure MCP with a verified absolute executable path instead of the bare agentic-route command.
4. Ensure the executable and all parent directories are owned by a trusted administrator and are not writable by unprivileged users.
5. Launch the MCP server with a minimal, explicitly defined PATH and a dedicated least-privileged service account.
6. Audit the missing implementation before deployment, especially the documented packet-capture, routing-rule modification, encrypted-DNS interception, database-access, REST API, and MCP server functionality.
7. Document the expected executable identity, installation location, permissions, version, and integrity-verification procedure so operators can validate it before activation.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill documents commands that can alter live routing behavior, remove upstreams, and force bypass/failover without any warning, confirmation step, or discussion of network impact. In an agent-facing skill, this is dangerous because an autonomous system may execute these actions directly, causing outages, traffic interception changes, or loss of name-resolution availability.

Content

No source excerpt is available for this finding.