Fanta Autoresearch

• Outcome: Review
• Latest audit: Sep 15, 2026 · 12:44 AM UTC
• Version: 1.0.0

Overview

The skill is an automation helper for iterative optimization, but it gives agents broad change-making and command-running patterns that need careful review before use.

Use this only for bounded optimization tasks where you are comfortable with an agent editing files and running explicit verification commands. Before enabling it, define the allowed files, maximum iterations, exact commands, timeout, rollback expectations, and whether subagents or background runs are allowed; avoid using it on sensitive directories or with unreviewed npx/package commands.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: references/metrics.md:59

Finding

Unpinned Third-Party Package Execution via npx

Content

View full analysis

Vulnerability Details

File Location: references/metrics.md:59
Vulnerability Type: Supply-chain exposure through unpinned package execution
Risk Level: Medium

Vulnerable Code Snippet:

bash

# Lighthouse score
npx lighthouse <url> --output=json | jq '.categories.performance.score'

Technical Analysis

The documented command invokes lighthouse through npx without specifying an audited package version or requiring an existing local installation. Depending on the npm and npx environment, this can cause the latest package version to be downloaded from the configured package registry and executed immediately.

The effective code is therefore not fixed at audit time. A compromised package release, transitive dependency, package registry, or registry configuration could introduce arbitrary lifecycle or runtime code. Because this command appears in the skill's recommended metric workflow, an agent following the documentation may execute that third-party code without separately reviewing it.

Attack Path

1. A user or agent selects the documented web-performance measurement workflow.
2. The agent executes npx lighthouse <url> --output=json.
3. If lighthouse is not already installed locally, npx resolves it through the configured npm registry.
4. An unpinned package version and its transitive dependencies are downloaded.
5. Any malicious package lifecycle scripts or runtime code execute under the account running the agent.
6. The malicious code can access resources available to that account, including project files, environment variables, network connectivity, and writable user files.

Impact Assessment

Successful exploitation could provide arbitrary code execution with the privileges of the user or agent process. The affected scope includes the current project workspace and any other files, credentials, environment variables, or network resources a ...[truncated 189 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin lighthouse to a reviewed version in the project's dependency manifest.

2. Commit the corresponding lockfile so package versions and integrity metadata are reproducible.

3. Install dependencies through a controlled, reviewed installation step rather than downloading code during metric execution.

4. Invoke only the previously installed local binary:

   bash

   npx --no-install lighthouse <url> --output=json |
     jq '.categories.performance.score'
   

5. In automated environments, use an approved registry, enforce lockfile integrity, disable unnecessary package lifecycle scripts where feasible, and run the command in a sandbox with minimal filesystem, credential, and network access.

6. Periodically review the pinned package and its transitive dependencies before upgrading.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (7)

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The trigger phrases are very broad, such as 'improve X', 'optimize Y', and 'iterate until', which can cause the skill to activate in many contexts beyond what the user intended. In this skill, over-activation is especially risky because activation leads to autonomous modification loops and command execution behavior, so a casual optimization request could escalate into code changes or long-running automation.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 98% confidence

Finding

The tool parameter --verify is fed directly into a shell command sink, making this a concrete tool-parameter abuse issue. In the context of an agent skill, this is more dangerous because agent-constructed or user-provided verification strings may be treated as operational inputs, enabling arbitrary command execution on the host running the skill.

Content

Scanner excerpt · scripts/autoresearch-loop.py (reported line 31)May include surrounding context.

python

def run_command(cmd: str) -> Tuple[int, str]:
    """Run shell command and return exit code + output."""
    result = subprocess.run(cmd, shell=True, capture_output=True, text=True)
    return result.returncode, result.stdout + result.stderr

def extract_metric(output: str, pattern: str) -> Optional[float]:

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill explicitly instructs autonomous loops that make file changes, commit/revert them, and run shell-based verification commands, but it declares no tool scope or permissions boundaries. That mismatch is dangerous because an agent may infer broad authority to write files and execute commands without explicit user-visible limits, increasing the chance of unintended or over-broad system modification.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The documentation describes autonomous file modification, committing changes, rollback behavior, subagent spawning, and shell command execution, but it does not present a clear user-facing warning about potential system impact. This is dangerous because users may not realize the skill can alter repositories, run benchmarks/tests, consume resources, or launch longer-lived/background processes, particularly when phrased as routine optimization workflow.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 97% confidence

Finding

The script executes the user-supplied --verify value via subprocess.run(..., shell=True), which allows shell metacharacters, command chaining, and environment expansion. In a skill intended to run iterative verification commands, this creates a direct command-injection surface if the verify string can be influenced by an untrusted user, agent, or upstream prompt.

Content

Scanner excerpt · scripts/autoresearch-loop.py (reported line 31)May include surrounding context.

python

def run_command(cmd: str) -> Tuple[int, str]:
    """Run shell command and return exit code + output."""
    result = subprocess.run(cmd, shell=True, capture_output=True, text=True)
    return result.returncode, result.stdout + result.stderr

def extract_metric(output: str, pattern: str) -> Optional[float]:

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest says this skill is for autonomous goal-directed iteration and iterative make-change → verify → keep/revert cycles. However, the script explicitly states it only runs the verification loop and requires changes to be made manually or by another agent, so its actual behavior is substantially narrower than the advertised autonomous optimization capability.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.