AgentShield Scanner

• Outcome: Review
• Latest audit: Sep 12, 2026 · 12:38 AM UTC
• Version: 0.5.1

Overview

The skill is a coherent security-scanner wrapper, but it tells users to run an unpinned remote npm package against local files.

Review the npm package and publisher before use, prefer an exact pinned version, and run it only in an isolated environment with read-only access to the intended scan target and no unnecessary credentials or environment secrets.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:18

Finding

Execution of an Unpinned Third-Party npm Package

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 18-32
Vulnerability Type: Unpinned third-party dependency execution
Risk Level: High

bash

# Basic scan
npx @elliotllliu/agent-shield scan ./path/to/skill/

# Pre-install check (GitHub URL, npm package, or local path)
npx @elliotllliu/agent-shield install-check https://github.com/user/repo

# JSON output for programmatic use
npx @elliotllliu/agent-shield scan ./path/to/skill/ --json

# Fail if score is below threshold
npx @elliotllliu/agent-shield scan ./path/to/skill/ --fail-under 70

# Scan .difypkg plugin archives
npx @elliotllliu/agent-shield scan ./plugin.difypkg

Technical Analysis

Every documented workflow invokes @elliotllliu/agent-shield through npx without specifying an exact package version. Depending on the local npm and npx configuration, this can cause the package to be retrieved from the npm registry and executed immediately.

Because the package reference is mutable, the code executed by a future user may differ from the code that existed when this Skill was audited. The project contains no package lockfile, integrity hash, vendored implementation, or local source code that would allow the effective scanner payload to be verified. The package's advertised scanning behavior therefore cannot be validated from this artifact.

This finding does not establish that the current npm package is malicious. It identifies an unsafe supply-chain boundary that would permit a compromised publisher account, malicious future release, registry compromise, or compromised transitive dependency to introduce arbitrary executable behavior.

Attack Path

1. An attacker compromises the npm publisher account, release process, package, or one of its transitive dependencies.
2. The attacker publishes a malicious release under the same package name.
3. A user or agent follows the commands documented in SKILL.md.
4. npx resolves the u ...[truncated 956 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the CLI to a specific, reviewed version, such as npx @elliotllliu/agent-shield@X.Y.Z, rather than resolving the latest release.
2. Add a lockfile and retain npm integrity metadata so installations resolve to reviewed artifacts.
3. Prefer installing dependencies with a lockfile-enforcing command and execute the pinned local binary instead of allowing npx to resolve a mutable package dynamically.
4. Publish or vendor the scanner source required by the Skill so reviewers can verify the implementation corresponding to the documented behavior.
5. Verify package provenance, signatures, checksums, publisher identity, and release history before use.
6. Disable or strictly control dependency lifecycle scripts where feasible.
7. Run the scanner in an isolated environment with read-only access to only the intended scan target, no unnecessary credentials, minimal environment variables, and restricted outbound network access.
8. Document the exact trusted version and update process, requiring a new security review before changing the pinned version.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (7)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 64)May include surrounding context.

md

**Low Risk:**
- `excessive-perms` — too many permissions declared
- `hidden-files` — .env with secrets committed
- `typosquatting` — suspicious npm package names

## Interpreting Results

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The skill documentation instructs users to execute an unpinned npm package via npx, which fetches the latest published version at runtime. If the package is later compromised, hijacked, or updated with malicious code, users following these instructions could execute attacker-controlled code.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

This command uses npx without an exact package version, so execution depends on whatever version is current in the registry at the time of use. That creates a supply-chain risk window where a malicious or accidental upstream change could lead to arbitrary code execution on the user's machine.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

An unversioned npx invocation allows silent drift to newer package releases, including compromised ones. Because npx executes package code, this can directly expose users to remote code execution through the package supply chain.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

Using npx @elliotllliu/agent-shield without a fixed version means the command is not reproducible and may execute a future compromised release. In a security-scanning tool, this is especially sensitive because users may run it in privileged environments against local files and repositories.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

This usage example relies on the latest package version at execution time, which introduces a supply-chain trust problem. If the package or publisher account is compromised, users can be induced to run malicious code simply by following the documented command.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The install-check example also uses an unpinned npx package reference, carrying the same package substitution and malicious update risk. Since this is framed as a pre-install trust check, users may have lowered suspicion, which increases the practical danger of executing an unexpected package version.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.