ogp-agent-comms

• Outcome: Review
• Latest audit: Sep 15, 2026 · 12:33 AM UTC
• Version: 0.6.0

Overview

The skill is mostly coherent, but it asks users to install and run an unpinned global npm tool and leaves persistent daemon/logging risks under-scoped.

Install only if you trust the `@dp-pcs/ogp` npm package and its update channel. Prefer a reviewed pinned version or isolated environment, avoid administrator shells, and review the resulting agent policies, activity logs, background daemon behavior, and human-delivery targets before enabling broad or autonomous peer access.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:12

Finding

Unpinned Globally Installed Third-Party Executable

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:12-17
Vulnerability Type: Unsafe installation and execution of an unpinned third-party dependency
Risk Level: Medium

Vulnerable Code

bash

npm install -g @dp-pcs/ogp
ogp-install-skills
ogp setup
ogp agent-comms interview
ogp config show

Technical Analysis

The Skill instructs users to globally install @dp-pcs/ogp without specifying an exact version or integrity hash and then immediately execute commands supplied by that package. Consequently, the installed content is determined by the package version associated with the mutable npm registry tag at installation time rather than by a version reviewed alongside this Skill.

A global npm installation also increases exposure beyond the project directory. Package lifecycle scripts may execute during installation, and the resulting command-line executables run with the permissions of the installing user. The instructions do not require provenance verification, integrity validation, dependency review, or lifecycle-script restrictions.

This finding does not establish that the current package is malicious. It identifies an unsafe supply-chain trust boundary that could become exploitable if the package, one of its dependencies, its publisher account, or the package distribution channel is compromised.

Attack Path

1. An attacker compromises the package publisher, a transitive dependency, or the relevant package distribution path, or publishes a malicious future release under the trusted package name.
2. The malicious release becomes the version resolved by the unpinned npm install -g @dp-pcs/ogp command.
3. A user follows the Skill instructions and downloads the mutable package release.
4. Malicious npm lifecycle logic may execute during installation, or attacker-controlled behavior executes when the user invokes ogp-install-skills, ogp setup, or another installed command.
5. The payload o ...[truncated 882 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the package to an explicitly reviewed version, for example:

   bash

   npm install -g @dp-pcs/ogp@0.2.28
   

   The selected version should match the functionality required by the Skill and should be updated only through a deliberate review process.

2. Publish and verify the expected package integrity digest or signed provenance before installation. Document the expected npm registry to prevent unintended registry substitution.

3. Prefer a project-local or isolated installation over a global installation where supported. Running the package in a dedicated container or restricted user account can further reduce impact.

4. Review the package and its dependency tree before recommending a new release. Include checks for unexpected lifecycle scripts, newly introduced executables, dependency ownership changes, and known vulnerabilities.

5. Consider initially installing with lifecycle scripts disabled:

   bash

   npm install --ignore-scripts @dp-pcs/ogp@<reviewed-version>
   

   If lifecycle scripts are required, document why they are necessary and review them before allowing execution.

6. Avoid running installation or setup commands with administrative privileges. State this requirement explicitly in the prerequisites.

7. Maintain a trusted update procedure that verifies release provenance, integrity, and behavioral changes before changing the pinned version.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill explicitly enables and exposes detailed agent-comms activity logging, including peer identities, topics, timestamps, and message content examples, but does not warn the operator about privacy, retention, or sensitivity risks. In this context, logs may capture federated conversations, human-relay requests, scheduling details, and other potentially sensitive cross-agent data, which increases the chance of unintended disclosure or over-retention.

Content

No source excerpt is available for this finding.