Fidacy Conversation Receipts

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 9:56 AM UTC
• Version: 1.0.0

Overview

The skill is a coherent receipt-and-gating integration, but users should pin and review the external npm SDK before using it with sensitive conversations.

Before installing, pin @fidacy/session to a reviewed version, use a lockfile or npm ci, and confirm what the SDK sends during anchoring and gate calls. Treat the external gate as part of your business approval path and use narrowly scoped API keys.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:25

Finding

Unpinned Third-Party npm Dependency

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 25
Vulnerability Type: Unpinned third-party dependency installation
Risk Level: Medium

Vulnerable Code Snippet:

markdown

1. Install: `npm i @fidacy/session` (free; anchoring needs a free API key from
   https://app.fidacy.com/signup, scope assess:write).

Technical Analysis

The installation instruction does not specify an exact version of @fidacy/session or provide a lockfile with an integrity hash. Consequently, npm resolves the package version from the registry at installation time. The resulting code may differ from the version that was originally reviewed or intended by the Skill author.

The dependency implementation is not included in this project, so its npm lifecycle scripts, runtime network behavior, hashing implementation, conversation-data handling, and API-key handling cannot be verified by this audit. Because npm packages can execute lifecycle scripts during installation and application code at runtime, a compromised package publisher, registry account, or later package release could introduce attacker-controlled code.

Attack Path

1. An attacker compromises the package publisher, registry account, release pipeline, or another component of the dependency supply chain.
2. The attacker publishes a malicious or compromised release under the existing @fidacy/session package name.
3. A user follows the documented npm i @fidacy/session instruction after that release becomes the version selected by npm.
4. npm downloads and installs the changed package without validating it against a project-supplied exact version and integrity lock.
5. Malicious lifecycle code may execute during installation, or malicious package logic may execute when the application imports and uses the dependency.
6. The malicious code runs with the privileges and environmental access of the npm or application process.

Impact Assessment

Success ...[truncated 739 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin @fidacy/session to a reviewed exact version instead of allowing npm to select a mutable release.
2. Provide a committed package-lock.json or equivalent lockfile containing registry integrity hashes.
3. Install dependencies through a reproducible command such as npm ci.
4. Document the expected official package registry and upstream source repository.
5. Review package contents and npm lifecycle scripts before approving a version.
6. Consider disabling lifecycle scripts during installation with npm ci --ignore-scripts when they are not required.
7. Run installation and application processes with least privilege, restricted filesystem access, limited outbound networking, and narrowly scoped secrets.
8. Use dependency monitoring and automated alerts for ownership changes, compromised releases, known vulnerabilities, and unexpected package updates.
9. Verify that the SDK transmits only the documented digest and does not expose conversation content or credentials before using it with sensitive conversations.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep