Security audit

Agent Reader

Security checks for vulnerabilities and agentic risk

Overview

This document-conversion skill is coherent, but its setup automatically runs an unpinned npm package, so the code actually executed can change outside the reviewed artifact.

Install only if you trust the npm package source, and prefer pinning the MCP command to the reviewed version, such as agent-reader@1.3.7, or installing from a controlled lockfile. Run it with least privilege, avoid feeding highly sensitive documents unless you are comfortable with /tmp/agent-reader output files, and be cautious with generated HTML from untrusted Markdown or image inputs.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:45
Finding: Unpinned npm Package Execution Through npx## Vulnerability Details **File Location**: `SKILL.md`, lines 45–46 **Vulnerability Type**: Unpinned third-party dependency execution **Risk Level**: Medium **Vulnerable code snippet**: ```json { "mcpServers": { "agent-reader": { "command": "npx", "args": ["-y", "agent-reader", "mcp"] } } } ``` ### Technical Analysis The documented MCP configuration executes the `agent-reader` npm package by name without specifying an exact version or verifying package integrity. Consequently, `npx` resolves the package version from the configured npm registry at execution time. The `-y` option suppresses the package-installation confirmation prompt. This creates a supply-chain trust boundary in which the code ultimately executed can change after the skill has been reviewed. If the npm package, its maintainer account, a transitive dependency, or the configured registry is compromised, a future invocation could download and execute attacker-controlled code. The package would execute with the operating-system permissions and environment inherited from the MCP host. The repository does provide an npm link, but it does not include a lockfile, integrity hash, exact package version, or other mechanism that binds installation to reviewed artifacts. ### Attack Path 1. A user copies the documented MCP configuration into an agent host. 2. An attacker compromises the `agent-reader` npm package, its publisher account, one of its dependencies, or the package registry used by the victim. 3. The attacker publishes a malicious version that still resolves under the unversioned package name. 4. The MCP host starts the server using `npx -y agent-reader mcp`. 5. `npx` retrieves the currently resolved package without an interactive confirmation prompt. 6. Malicious package installation hooks or runtime code execute under the MCP host user's account. ### Impact Assessment Successful exploitation could provide arbi ...[truncated 570 chars]
Remediation: ## Remediation Suggestions - Pin the package to a specific reviewed version, for example: ```json { "command": "npx", "args": ["-y", "agent-reader@1.3.7", "mcp"] } ``` - Prefer installing from a lockfile-controlled project using `npm ci`, with the lockfile committed and reviewed. - Verify package integrity using npm lockfile integrity metadata or a separately maintained cryptographic digest. - Review and monitor direct and transitive dependencies for unexpected ownership, release, and lifecycle-script changes. - Avoid automatic remote installation during routine MCP startup. Install the audited artifact in a controlled deployment step and execute the local pinned binary. - Run the MCP server under a dedicated, least-privileged account or sandbox with restricted filesystem, environment-variable, process, and network access. - Consider disabling lifecycle scripts during installation where compatible, and permit only explicitly reviewed scripts.

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The trigger guidance uses very broad, everyday phrases such as requests to format, export, or open files, which can cause the skill to be invoked in situations the user did not explicitly intend. In an agent setting, over-broad invocation increases the chance of unnecessary file generation, external package installation, or file handling side effects, especially because this skill can write outputs to disk and auto-select behavior via preferences.

Natural-Language Policy Violations

Low

Confidence: 76% confidence
Finding: The natural-language description and headings present bilingual content by default, including Chinese text, but do not indicate whether language selection is user-configurable or intentionally region-specific. This can be interpreted as imposing a locale presentation choice without explicit user opt-in.

Missing User Warnings

Low

Confidence: 88% confidence
Finding: The skill notes mention output paths and some return-content behavior, but the description does not clearly and prominently warn that outputs may be written to disk by default. In agent environments, implicit disk writes can expose sensitive document contents to local storage, temporary directories, or later access by other processes/users depending on the host configuration.

Missing User Warnings

Low

Confidence: 88% confidence
Finding: Exposing an auto_open option for generated HTML can cause an agent-driven workflow to launch local rendered content without a clear warning or explicit approval step. In a document-rendering skill that processes user-supplied markdown, this increases risk because rendered HTML may include active content or unsafe links, creating a path to local browser-based script execution or unwanted navigation.

Missing User Warnings

Low

Confidence: 84% confidence
Finding: This manifest-like schema documents tools that export documents and return file paths or file content, indicating file creation on the user's system. The descriptions explain functionality but do not warn that the tool may create output files alongside existing content or otherwise affect local files, which is a user-impacting behavior.

Vague Triggers

Low

Confidence: 78% confidence
Finding: This JSON schema is a manifest-type file, so vague-trigger checks apply. Descriptions such as "Create slideshow HTML from an image directory" and similar tool descriptions describe capabilities but do not specify any explicit trigger phrases, scope limits, or exclusion conditions, which can make invocation criteria overly ambiguous in agent routing contexts.

Static analysis

No suspicious patterns detected.