Security audit

Ogp

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent for OGP federation, but it enables broad peer privileges and remote agent-facing input by default, with an unpinned global CLI install.

Install only if you trust the @dp-pcs/ogp package source and the peers you federate with. Prefer pinning and verifying the CLI version, granting only the scopes you need, using approval-required handling for inbound agent work, and backing up state before any peers.json reset.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:22
Finding: Unpinned Third-Party Package Installed Globally
Content: View full analysis
Remediation: View remediation
``` 2. Publish and verify the expected npm tarball integrity hash or signed provenance before installation. 3. Remove the recommendation to install `@latest` as a troubleshooting step. 4. Prefer a project-local dependency with a lockfile over a global installation. 5. Audit all direct and transitive dependencies, lifecycle scripts, and published package contents. 6. Where compatible with the package, install with lifecycle scripts disabled: ```bash npm install --ignore-scripts ``` 7. Run the daemon under a dedicated, minimally privileged operating-system account that cannot access unrelated user data. 8. Document the expected package publisher, source repository, version, checksums, and verification procedure so users can detect package substitution. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

Location: SKILL.md:252
Finding: Federation Approval Grants Broad Capabilities and Delivers Remote Content to a Local Agent
Content: View full analysis
4. Scopes auto-granted + "general" topic auto-enabled ✓ 5. Test: ogp --for federation age ...[truncated 3145 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · SKILL.md (reported line 387)May include surrounding context.
Old way — manual URL exchange (still works)

text
1. Get peer's gateway URL (they share it with you) 2. Check their card: curl -s <url>/.well-known/ogp | python3 -m json.tool 3. Request federation: ogp --for <framework> federation request <url> 4. They approve on their side (or you approve if they requested) → Scopes auto-granted + "general" topic auto-enabled ✓

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill instructs users to overwrite peers.json with an empty array, which destructively deletes federation state. Although it recommends making a backup first, it does not clearly warn that this severs trust relationships, may require full re-federation/re-approval, and can cause loss of operational context if the backup is not restored correctly.
Content: No source excerpt is available for this finding.