glasser

• Outcome: Review
• Latest audit: Sep 14, 2026 · 7:49 AM UTC
• Version: 0.1.2

Overview

This is a coherent paid-data integration, but its unpinned global CLI install and persistent credential/tooling behavior should be reviewed before use.

Install only if you are comfortable with Glasser spending a workspace balance for paid data calls and sending task inputs to Glasser and its selected providers. Prefer the MCP tools when possible; if the CLI is needed, use a pinned, isolated install rather than a global `@latest` install, and review the endpoint price before authorizing paid or higher-volume runs.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:49
• Finding: Unpinned Global Installation of a Mutable npm Package## Vulnerability Details **File Location**: `SKILL.md:49` (repeated at `SKILL.md:249` and `SKILL.md:287`) **Vulnerability Type**: Supply-chain risk from an unpinned global dependency **Risk Level**: Medium ### Vulnerable Code ```sh glasser --version 2>/dev/null || npm install -g @glasser-ai/cli@latest ``` The same unsafe upgrade instruction is repeated later: ```sh npm install -g @glasser-ai/cli@latest ``` ### Technical Analysis The Skill instructs the Agent to install or upgrade `@glasser-ai/cli` globally using npm's mutable `latest` distribution tag. Because no exact version or integrity value is specified, the package contents executed during installation can differ from those reviewed when the Skill was audited. npm installation can execute package lifecycle scripts, including installation hooks, with the privileges of the user running npm. The `-g` option also modifies the user's global Node.js toolchain rather than creating an isolated, project-scoped installation. This behavior exceeds the minimum privileges needed for the Skill's core functionality because the document states that bundled MCP tools are available by default and that the CLI is optional. This finding does not establish that the current npm package is malicious. The vulnerability is the trust placed in a mutable remote package release and the automatic global installation process. ### Attack Path 1. An attacker compromises the npm package, its publisher account, the publication process, or another component of the package's dependency chain. 2. The attacker publishes a malicious version under the `latest` tag. 3. The Agent follows the Skill instruction when the CLI is missing or an update notice appears. 4. npm retrieves the then-current package and its dependency tree without enforcing a reviewed version or integrity value. 5. Malicious package lifecycle code executes during installation, or malicious CLI code executes when the Agent subs ...[truncated 941 chars]
• Remediation: ## Remediation Suggestions 1. Prefer the bundled MCP tools and remove automatic CLI installation where the CLI is not required. 2. Require explicit user approval before installing or upgrading software, especially globally installed packages. 3. Pin the CLI to an exact reviewed version instead of using `@latest`, for example: ```sh npm install --global @glasser-ai/cli@0.1.2 ``` 4. Verify the package version, provenance, signatures where available, and expected integrity before installation. 5. Avoid global installation. Use an isolated project directory, a locked dependency file, a container, or another sandbox with restricted filesystem and network access. 6. Disable or tightly control npm lifecycle scripts when compatible with the package: ```sh npm install --ignore-scripts --save-exact @glasser-ai/cli@0.1.2 ``` This should only be used after confirming that the package does not legitimately require installation scripts. 7. Replace automatic update instructions at lines 249 and 287 with a controlled update process that reviews the target version before installation. 8. Run the CLI under a least-privileged account and expose only the credentials and files required for the specific operation.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The trigger description is extremely broad and encourages invoking this paid external-data skill for many generic tasks involving search, scraping, enrichment, or inaccessible data. That can cause unnecessary use of third-party services, increased data exposure, and unintended spending when a safer built-in or user-provided integration would have sufficed.

Context Window Stuffing

Medium

• Category: Memory Poisoning

Content

Workspace and balance, and the rules below apply to both. Only `run`
differs: the tool needs an `idempotency_key` you generate (a UUID); the CLI
generates one for you. Use the MCP tools by default. Switch to the CLI when
a result would flood the context (`-o <file>`, then read selectively), for
scripting, or in CI. To connect a client without this plugin, read
https://glasser.ai/docs/mcp-server.md rather than writing a config from
memory.

• Confidence: 85% confidence
• Finding: Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

Keep the turn active and check the pending shell command about every five
seconds until it completes; the CLI polls for browser approval for up to
15 minutes. Once login succeeds, use the available balance in its output
and continue to **First run** without asking for a chat reply, unless login
warns that `GLASSER_API_KEY` overrides the saved Key. With that warning,
or if the summary has no available balance, run `glasser balance` in the
environment subsequent commands will use. Login's summary uses the new

• Confidence: 84% confidence
• Finding: The instruction to continue to first run without asking for a chat reply enables the agent to transition from authentication directly into operational use of a paid external API. In this skill context, that can lead to autonomous spending or data retrieval beyond the user's most recent explicit confirmation, especially because runs charge a workspace balance.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

Key directly; it does not verify an environment Key. If the check fails,
resolve the override or report that authentication is still blocked; another
login will not fix it. If the authorization expired, start a new login.
Never ask the user to paste a Key.

**Nobody is present** (CI, scripts, scheduled jobs): set `GLASSER_API_KEY`
to a Key minted in the console, or store one with `glasser keys add --label

• Confidence: 80% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

without naming the per-call Price and getting the user's go-ahead.
4. Start with small volume parameters; raise them only on request.
5. Auth is the client's own sign-in (MCP tools) or `glasser login` (CLI) —
   never ask the user to paste a Key into the conversation.
6. On an ambiguous failure, retry with the SAME Idempotency-Key.
7. Report two indicators after every run — the Run status and what the
   provider said — plus the printed `Charge:` amount, and the `Run URL` as a

• Confidence: 80% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Static analysis

No suspicious patterns detected.