Security audit

Ping Model

Security checks for vulnerabilities and agentic risk

Overview

This skill appears non-destructive, but it presents simulated latency numbers as real model measurements, so users could be misled by its results.

Install only if you are comfortable treating this as a demo or formatting utility, not a real latency benchmark. Do not rely on its model rankings or timing output for operational decisions unless the implementation is changed to perform real requests and clearly disclose any environment inspection.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill’s declared purpose is a simple /ping latency check, but the described behavior expands to simulated measurements, standalone CLI operation, model switching/comparison, and reading session status through shell commands without clearly declared permissions. This kind of capability mismatch is dangerous because it can mislead operators about what the skill actually does, hide unexpected execution paths, and normalize unauthorized environment inspection or shell access under a benign-seeming utility.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The skill metadata and help text claim to measure real model latency and support cross-model testing, but the implementation only sleeps for randomized preset delays and never actually switches models or performs a live request. This is a security-relevant integrity issue because users may make operational or trust decisions based on fabricated benchmarking data, and the deception is amplified by the tool presenting authoritative timestamps and rankings.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The inline comment admits the current behavior is only a demo, but the shipped tool still exposes the simulated behavior as if it were a functional latency utility. This mismatch increases the chance that maintainers or users overlook the fact that results are synthetic, causing misleading performance conclusions and weakening trust in the skill's stated behavior.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/ping-model.js:53