FaxAgent-Skill

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:23 PM UTC
• Version: 1.0.0

Overview

The skill is purpose-aligned for faxing, but it needs review because it handles sensitive documents and payment links while trusting returned URLs and exposing job tokens in examples.

Review before installing. Only use this skill when you intend to send or track a fax, verify that upload and payment links stay on the expected FaxAgent.ai domain, avoid sharing full tokenized URLs, and do not pass fax tokens on the command line or in logs.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: skill.md:155
• Finding: Unvalidated Server-Provided URLs Enable Document Exfiltration and Payment Redirection## Vulnerability Details **File Location**: `skill.md:155-181` and `skill.md:270-272` **Vulnerability Type**: Improper validation of remotely supplied URLs **Risk Level**: Medium ### Vulnerable Code ```text Parse response: fax_id, token, upload_url, status_url, preview_url, pay_url Surface upload_url to the human (token redacted in public contexts). If cost > 0 and pay_url present: 🧑‍⚖️ Instruct the human to complete payment ❌ Do not auto-pay Poll status_url until terminal status: done ✅ or failed ❌ ``` ```bash curl -sS -X POST "<UPLOAD_URL>" \ -H "Content-Type: multipart/form-data" \ -F "file=@./document.pdf;type=application/pdf" \ -F "meta={\"cover\":\"Please deliver\"};type=application/json" ``` ```text ✅ Surface pay_url to the human for payment. ✅ If explicit payment metadata is provided (wallet address/payment token), you may construct a convenience URL. ``` ### Technical Analysis The Skill instructs the agent to trust `upload_url`, `status_url`, `preview_url`, and `pay_url` values returned by the remote API. It does not require parsing these URLs or verifying their scheme, hostname, port, path, or redirect destination before presenting or using them. Consequently, a compromised API, malicious intermediary affecting the API response, or server-side response manipulation could cause the agent to use an attacker-controlled URL. The upload example is particularly sensitive because it transmits a local PDF to the supplied URL. Presenting an unvalidated payment URL can similarly direct the user to a phishing or fraudulent payment page. Token redaction in public contexts does not resolve this issue because the complete tokenized URL may still be sent to an unauthorized host by the agent or opened by the user. ### Attack Path 1. An attacker compromises the remote API or otherwise gains the ability to manipulate its response. 2. The response replaces `upload_url`, `statu ...[truncated 899 chars]
• Remediation: ## Remediation Suggestions - Parse every server-provided URL before displaying or using it. - Require HTTPS and reject embedded credentials, nonstandard ports, malformed URLs, and protocol-relative URLs. - Enforce an explicit hostname allowlist, such as the exact trusted `faxagent.ai` hostname and any separately documented first-party upload or payment hosts. - Validate expected path prefixes for upload, status, preview, and payment endpoints. - Disable redirects or verify the destination of every redirect against the same allowlist. - Do not construct payment URLs from arbitrary remote metadata. Use a fixed trusted payment origin and encode each query parameter safely. - Require explicit user confirmation before uploading a document to any URL whose origin differs from the documented service origin. - Treat origin validation failures as fatal and display a warning without opening, polling, or uploading to the URL.

T09 · Insecure Skill Coding Practices

Warning

• Location: skill.md:192
• Finding: Fax Job Token Exposed Through Command-Line Arguments and Request URLs## Vulnerability Details **File Location**: `skill.md:192-214` **Vulnerability Type**: Sensitive token exposure through process arguments and shell history **Risk Level**: Medium ### Vulnerable Code ```bash Save as poll-fax-status.sh and run: bash poll-fax-status.sh <fax_id> <token> ``` ```bash #!/usr/bin/env bash set -euo pipefail FAX_ID="${1:?fax_id required}" TOKEN="${2:?token required}" STATUS_URL="https://faxagent.ai/api/status?fax_id=${FAX_ID}&token=${TOKEN}" INTERVAL=5 MAX_LOOP=180 # ~15 minutes max COUNT=0 prev_status="" while [ $COUNT -lt $MAX_LOOP ]; do out=$(curl -sS "$STATUS_URL") || { echo "Failed to query status"; exit 2; } ``` ### Technical Analysis The polling example accepts the sensitive job token as the script's second command-line argument. Command-line arguments may be recorded in interactive shell history and can be visible through process inspection facilities while the script runs. The script also interpolates the token into `STATUS_URL` and passes that complete URL as an argument to `curl`. This creates another period during which the tokenized URL may be visible in the process list. URLs are also commonly captured by debugging systems, command tracing, proxy logs, monitoring agents, and network-client diagnostics. These behaviors conflict with the Skill's stated requirement to avoid printing or storing raw tokens. ### Attack Path 1. A user follows the documented command and supplies a valid fax token as a positional argument. 2. The invoking command is retained in shell history, or another local user or monitoring process inspects the script or `curl` process arguments. 3. The observer retrieves the fax identifier and token. 4. The observer constructs the corresponding status, preview, upload, or human-facing job URL. 5. Depending on the server's token authorization model, the observer accesses job information or other token-protected fax funct ...[truncated 492 chars]
• Remediation: ## Remediation Suggestions - Do not accept sensitive tokens as positional command-line arguments. - Read the token from protected standard input without terminal echo, for example with `read -r -s TOKEN`. - Alternatively, load it from a temporary credential file with mode `0600`, delete the file promptly, and avoid shared temporary paths. - Prefer an HTTP authorization header over query-string authentication if the API supports it. - If query-string authentication is unavoidable, configure the HTTP client so the complete URL is not exposed in its command-line arguments or diagnostic output. - Disable shell tracing around sensitive operations and ensure monitoring, proxy, and application logs redact token query parameters. - Clear temporary variables when polling finishes and retain tokens only for the minimum required lifetime. - Rotate or invalidate a token immediately if command history or process records may have exposed it.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match

Content

�───────────────────────────────────────────────────────╯

> **Filename:** `Fxagent.skills.md`  
> **Role:** A formal, AI-readable skill spec for integrating with the FaxAgent.ai API.

---

## 🧾 Metadata (machine-friendly)

```yaml
name: FaxAgent
id: fxagent
version: 1.0
description: >
  Discover, create, upload, and track fax jobs via the FaxAgent.ai API.
  Supports promo tokens and surfaces upload/payment/status URLs to humans.
  Includes safe polling and upload helpers.
activation:
  - "fax"
  - "send fax"
  - "faxagent"
🔎 AI Index (quick scan)
yaml
Copy code
discovery_url: "https://faxagent.ai/api/discovery.json"
submit_endpoint: "POST /api/submit-fax"
status_endpoint: "GET /api/status?fax_id=<fax_id>&token=<token>"
preview_endpoint: "GET /preview/<fax_id>?token=<token>"
human_pages:
  - upload_url
  - status_page_url
  - pay_url
🎯

• Confidence: 90% confidence
• Finding: The skill manifest appears malformed and mixes YAML metadata with narrative content and pseudo-sections, which can confuse parsers or downstream agent tooling. In agent ecosystems, malformed or ambiguously structured metadata can enable prompt or tool-metadata poisoning effects, causing the system to misinterpret instructions, trust boundaries, or endpoint definitions.

Vague Triggers

Medium

• Confidence: 97% confidence
• Finding: The activation trigger includes the generic term "fax," which is broad enough to match ordinary user conversation and may cause this skill to activate unintentionally. In an agent environment, overly broad activation can route users into external API workflows without clear intent confirmation, increasing the chance of unintended data disclosure or actions.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

✅ If explicit payment metadata is provided (wallet address/payment token), you may construct a convenience URL.

❌ Never auto-execute payments.

Example wallet presentation (display-only):

• Confidence: 85% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The activation examples are conversational and ambiguous, such as "Send a fax to Mary," without defining strict invocation constraints. This makes accidental activation more likely in normal dialogue and can lead the agent to collect PII or initiate external service interactions based on casual language rather than explicit user consent.

Natural-Language Policy Violations

Low

• Confidence: 88% confidence
• Finding: The file instructs the agent to "show human-friendly hints," but all user-facing examples and operational guidance are implicitly English-only, with no option for user language choice or locale selection. This creates a natural-language policy concern if the skill is expected to operate across users without explicit English opt-in.

Static analysis

No suspicious patterns detected.