Agent Reader

• Outcome: Review
• Latest audit: Sep 12, 2026 · 2:03 AM UTC
• Version: 1.3.7

Overview

This document-conversion skill is coherent, but its setup automatically runs an unpinned npm package, so the code actually executed can change outside the reviewed artifact.

Install only if you trust the npm package source, and prefer pinning the MCP command to the reviewed version, such as agent-reader@1.3.7, or installing from a controlled lockfile. Run it with least privilege, avoid feeding highly sensitive documents unless you are comfortable with /tmp/agent-reader output files, and be cautious with generated HTML from untrusted Markdown or image inputs.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:45

Finding

Unpinned npm Package Execution Through npx

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 45–46
Vulnerability Type: Unpinned third-party dependency execution
Risk Level: Medium

Vulnerable code snippet:

json

{
  "mcpServers": {
    "agent-reader": {
      "command": "npx",
      "args": ["-y", "agent-reader", "mcp"]
    }
  }
}

Technical Analysis

The documented MCP configuration executes the agent-reader npm package by name without specifying an exact version or verifying package integrity. Consequently, npx resolves the package version from the configured npm registry at execution time. The -y option suppresses the package-installation confirmation prompt.

This creates a supply-chain trust boundary in which the code ultimately executed can change after the skill has been reviewed. If the npm package, its maintainer account, a transitive dependency, or the configured registry is compromised, a future invocation could download and execute attacker-controlled code. The package would execute with the operating-system permissions and environment inherited from the MCP host.

The repository does provide an npm link, but it does not include a lockfile, integrity hash, exact package version, or other mechanism that binds installation to reviewed artifacts.

Attack Path

1. A user copies the documented MCP configuration into an agent host.
2. An attacker compromises the agent-reader npm package, its publisher account, one of its dependencies, or the package registry used by the victim.
3. The attacker publishes a malicious version that still resolves under the unversioned package name.
4. The MCP host starts the server using npx -y agent-reader mcp.
5. npx retrieves the currently resolved package without an interactive confirmation prompt.
6. Malicious package installation hooks or runtime code execute under the MCP host user's account.

Impact Assessment

Successful exploitation could provide arbi ...[truncated 570 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the package to a specific reviewed version, for example:

  json

  {
    "command": "npx",
    "args": ["-y", "agent-reader@1.3.7", "mcp"]
  }
  

• Prefer installing from a lockfile-controlled project using npm ci, with the lockfile committed and reviewed.

• Verify package integrity using npm lockfile integrity metadata or a separately maintained cryptographic digest.

• Review and monitor direct and transitive dependencies for unexpected ownership, release, and lifecycle-script changes.

• Avoid automatic remote installation during routine MCP startup. Install the audited artifact in a controlled deployment step and execute the local pinned binary.

• Run the MCP server under a dedicated, least-privileged account or sandbox with restricted filesystem, environment-variable, process, and network access.

• Consider disabling lifecycle scripts during installation where compatible, and permit only explicitly reviewed scripts.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger guidance uses very broad, everyday phrases such as requests to format, export, or open files, which can cause the skill to be invoked in situations the user did not explicitly intend. In an agent setting, over-broad invocation increases the chance of unnecessary file generation, external package installation, or file handling side effects, especially because this skill can write outputs to disk and auto-select behavior via preferences.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 76% confidence

Finding

The natural-language description and headings present bilingual content by default, including Chinese text, but do not indicate whether language selection is user-configurable or intentionally region-specific. This can be interpreted as imposing a locale presentation choice without explicit user opt-in.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill notes mention output paths and some return-content behavior, but the description does not clearly and prominently warn that outputs may be written to disk by default. In agent environments, implicit disk writes can expose sensitive document contents to local storage, temporary directories, or later access by other processes/users depending on the host configuration.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

Exposing an auto_open option for generated HTML can cause an agent-driven workflow to launch local rendered content without a clear warning or explicit approval step. In a document-rendering skill that processes user-supplied markdown, this increases risk because rendered HTML may include active content or unsafe links, creating a path to local browser-based script execution or unwanted navigation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

This manifest-like schema documents tools that export documents and return file paths or file content, indicating file creation on the user's system. The descriptions explain functionality but do not warn that the tool may create output files alongside existing content or otherwise affect local files, which is a user-impacting behavior.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

This JSON schema is a manifest-type file, so vague-trigger checks apply. Descriptions such as "Create slideshow HTML from an image directory" and similar tool descriptions describe capabilities but do not specify any explicit trigger phrases, scope limits, or exclusion conditions, which can make invocation criteria overly ambiguous in agent routing contexts.

Content

No source excerpt is available for this finding.