Security checks for vulnerabilities and agentic risk
Overview
This is a coherent paid-data integration, but its unpinned global CLI install and persistent credential/tooling behavior should be reviewed before use.
Install only if you are comfortable with Glasser spending a workspace balance for paid data calls and sending task inputs to Glasser and its selected providers. Prefer the MCP tools when possible; if the CLI is needed, use a pinned, isolated install rather than a global `@latest` install, and review the endpoint price before authorizing paid or higher-volume runs.
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
T08 · Insecure Dependencies
Warning
Location
SKILL.md:49
Finding
Unpinned Global Installation of a Mutable npm Package
Content
View full analysis
Vulnerability Details
File Location: SKILL.md:49 (repeated at SKILL.md:249 and SKILL.md:287) Vulnerability Type: Supply-chain risk from an unpinned global dependency Risk Level: Medium
The same unsafe upgrade instruction is repeated later:
sh
npm install -g @glasser-ai/cli@latest
Technical Analysis
The Skill instructs the Agent to install or upgrade @glasser-ai/cli globally using npm's mutable latest distribution tag. Because no exact version or integrity value is specified, the package contents executed during installation can differ from those reviewed when the Skill was audited.
npm installation can execute package lifecycle scripts, including installation hooks, with the privileges of the user running npm. The -g option also modifies the user's global Node.js toolchain rather than creating an isolated, project-scoped installation. This behavior exceeds the minimum privileges needed for the Skill's core functionality because the document states that bundled MCP tools are available by default and that the CLI is optional.
This finding does not establish that the current npm package is malicious. The vulnerability is the trust placed in a mutable remote package release and the automatic global installation process.
Attack Path
An attacker compromises the npm package, its publisher account, the publication process, or another component of the package's dependency chain.
The attacker publishes a malicious version under the latest tag.
The Agent follows the Skill instruction when the CLI is missing or an update notice appears.
npm retrieves the then-current package and its dependency tree without enforcing a reviewed version or integrity value.
Malicious package lifecycle code executes during installation, or malicious CLI code executes when the Agent subs
...[truncated 941 chars]
Remediation
View remediation
Remediation Suggestions
Prefer the bundled MCP tools and remove automatic CLI installation where the CLI is not required.
Require explicit user approval before installing or upgrading software, especially globally installed packages.
Pin the CLI to an exact reviewed version instead of using @latest, for example:
sh
npm install --global @glasser-ai/cli@0.1.2
Verify the package version, provenance, signatures where available, and expected integrity before installation.
Avoid global installation. Use an isolated project directory, a locked dependency file, a container, or another sandbox with restricted filesystem and network access.
Disable or tightly control npm lifecycle scripts when compatible with the package:
sh
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (5)
Vague Triggers
Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding
The trigger description is extremely broad and encourages invoking this paid external-data skill for many generic tasks involving search, scraping, enrichment, or inaccessible data. That can cause unnecessary use of third-party services, increased data exposure, and unintended spending when a safer built-in or user-provided integration would have sufficed.
Content
No source excerpt is available for this finding.
Context Window Stuffing
Medium
Category
Memory Poisoning
Confidence
85% confidence
Finding
Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.
Content
Scanner excerpt · SKILL.md (reported line 84)May include surrounding context.
md
Workspace and balance, and the rules below apply to both. Only `run`
differs: the tool needs an `idempotency_key` you generate (a UUID); the CLI
generates one for you. Use the MCP tools by default. Switch to the CLI when
a result would flood the context (`-o <file>`, then read selectively), for
scripting, or in CI. To connect a client without this plugin, read
https://glasser.ai/docs/mcp-server.md rather than writing a config from
memory.
Autonomous Decision Making
Medium
Category
Excessive Agency
Confidence
84% confidence
Finding
The instruction to continue to first run without asking for a chat reply enables the agent to transition from authentication directly into operational use of a paid external API. In this skill context, that can lead to autonomous spending or data retrieval beyond the user's most recent explicit confirmation, especially because runs charge a workspace balance.
Content
Scanner excerpt · SKILL.md (reported line 115)May include surrounding context.
md
Keep the turn active and check the pending shell command about every five
seconds until it completes; the CLI polls for browser approval for up to
15 minutes. Once login succeeds, use the available balance in its output
and continue to **First run** without asking for a chat reply, unless login
warns that `GLASSER_API_KEY` overrides the saved Key. With that warning,
or if the summary has no available balance, run `glasser balance` in the
environment subsequent commands will use. Login's summary uses the new
Autonomous Decision Making
Medium
Category
Excessive Agency
Confidence
80% confidence
Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content
Scanner excerpt · SKILL.md (reported line 122)May include surrounding context.
md
Key directly; it does not verify an environment Key. If the check fails,
resolve the override or report that authentication is still blocked; another
login will not fix it. If the authorization expired, start a new login.
Never ask the user to paste a Key.
**Nobody is present** (CI, scripts, scheduled jobs): set `GLASSER_API_KEY`
to a Key minted in the console, or store one with `glasser keys add --label
Autonomous Decision Making
Medium
Category
Excessive Agency
Confidence
80% confidence
Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content
Scanner excerpt · SKILL.md (reported line 279)May include surrounding context.
md
without naming the per-call Price and getting the user's go-ahead.
4. Start with small volume parameters; raise them only on request.
5. Auth is the client's own sign-in (MCP tools) or `glasser login` (CLI) —
never ask the user to paste a Key into the conversation.
6. On an ambiguous failure, retry with the SAME Idempotency-Key.
7. Report two indicators after every run — the Run status and what the
provider said — plus the printed `Charge:` amount, and the `Run URL` as a
