Security audit

fidacy-fraud-detector

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent and not malicious, but it asks users to rely on an unpinned external npm verifier for payment-related trust decisions.

Review and pin the verifier dependency before relying on this skill for payment or approval decisions. Use a lockfile or reviewed version, confirm JWKS fetching is restricted to trusted HTTPS issuer endpoints, and define which issuers and freshness windows your agent should accept.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:45
Finding: Unpinned and Unauditable Third-Party Verification Dependency
Content: View full analysis
Remediation: View remediation
``` 2. Provide and enforce a lockfile containing registry resolution and integrity metadata. Use `npm ci` in controlled deployments so dependency resolution cannot silently change. 3. Review and document the dependency's source, maintainers, transitive dependencies, lifecycle scripts, and cryptographic-verification behavior before deployment. 4. Disable npm lifecycle scripts during installation where compatible: ```bash npm ci --ignore-scripts ``` 5. Consider vendoring a minimal, auditable verifier or publishing its reviewed source alongside the Skill. 6. Pin the accepted signature algorithm to Ed25519/EdDSA and reject algorithm substitution, missing signatures, unknown key identifiers, malformed claims, stale verdicts, and untrusted issuers. 7. Restrict JWKS retrieval to an explicit HTTPS allowlist. For the documented use case, permit only the intended Fidacy endpoint or a configured set of trusted issuer endpoints. 8. Reject redirects to non-allowlisted hosts, non-HTTPS schemes, embedded credentials, unusual ports, loopback addresses, link-local addresses, private network ranges, and hostnames that resolve to such addresses. 9. Apply network timeouts, response-size limits, content-type validation, key-cache controls, and safe failure behavior. Verification or network errors must result in rejection rather than approval. 10. Document precisely whether the JWS or its claims leave the local process. If telemetry exists, make it opt-in, minimize collected data, and prohibit transmission of credentials or unrelated sensitive context. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 45)May include surrounding context.
// r.claims ⇒ { issuer, decision, score, assessed_at, ... }

text
Or check by hand against the public keys at `https://api.fidacy.com/.well-known/jwks.json` (EdDSA, `alg` pinned). 3. **Gate on the result:** - `valid === false` → **fraud: do not act.** The approval is forged, tampered,

Static analysis

No suspicious patterns detected.