Security audit

Agent Topology Visualizer

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent diagram generator, but crafted topology files can inject JavaScript into the generated HTML.

Use this only with topology JSON that you wrote or trust. Do not open or publish generated HTML from third-party topology files until the generator validates IDs, colors, counts, fonts, and replaces innerHTML/raw JavaScript interpolation with safe serialization and textContent-style rendering.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/generate.py:208
Finding: Stored Cross-Site Scripting Through Unsafe Topology Data Interpolation
Content: View full analysis
') ``` #### Unescaped node IDs in generated SVG elements — lines 224-261 ```python if ntype == "orchestrator": return f''' {emoji} {name} {subtitle} ''' elif ntype == "system": return f''' {emoji} {name} {subtitle} ''' elif ntype == "agent": return f''' {emoji} {name} {subtitle} ''' elif ntype == "human": re ...[truncated 6070 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill instructs users to run a local generator that writes output files such as diagram.html and diagram.svg, but the skill metadata declares no explicit tool scope or permissions. This creates an authorization and transparency gap: an agent may perform file-write actions without an allowlisted declaration, making it harder to enforce least privilege and easier for future changes to expand write behavior unnoticed.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: This is a real DOM XSS issue in the generated output, even though the finding is anchored near the CSS sanitizer. Topology data is inserted into SVG data-* attributes without escaping the node id, then later read by JavaScript and rendered with tip.innerHTML; additionally, untrusted fields such as background.starColor are interpolated directly into inline
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The generated HTML hard-codes <html lang="en">, which imposes a specific language/locale choice on all outputs. This is a natural-language policy concern because the file does not offer a user-selectable locale or explain why English is required.
Content: No source excerpt is available for this finding.