Security audit

AgentFiles

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent AgentFiles wrapper, but it can install mutable npm code and transmit/share conversation or artifact content with under-specified safety controls.

Review the exact AgentFiles recipient, namespace, and payload before approving any publish or handoff. Treat share URLs and API keys as secrets, avoid command-line API keys where possible, use watch --exec only with trusted scripts, and prefer a pinned or administrator-installed agentfiles CLI rather than downloading the latest npm package at runtime.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:17
Finding: Unpinned npm Dependency May Execute Unreviewed Supply-Chain Code
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: installable/handoff/SKILL.md:17
Finding: Handoff Workflow May Publish Excessive or Sensitive Conversation Content
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Behavioral ASTexec() Call, eval() Call, Dynamic Import
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: The skill explicitly allows falling back to npx/npm to obtain and run agentfiles-cli without pinning a specific version. That creates a supply-chain risk: a compromised package, typosquat, or unexpected upstream update could be executed at runtime with the user's privileges. In this skill context, the danger is elevated because the tool is intended to handle artifacts, credentials, and networked operations, so executing an unpinned remote CLI can expose local data or auth context.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 80% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · SKILL.md (reported line 78)May include surrounding context.
md
- Always use the `artifact_publish` MCP tool. Do not shell out to the CLI. - Ask the user for confirmation before publishing the handoff artifact. - Keep the content focused and actionable. The recipient agent should be able to pick up the work without extra context. - If no namespace is configured, the MCP server will use the default. Do not ask the user for a namespace unless the publish fails.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 80% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · installable/handoff/SKILL.md (reported line 42)May include surrounding context.
md
- Always use the `artifact_publish` MCP tool. Do not shell out to the CLI. - Ask the user for confirmation before publishing the handoff artifact. - Keep the content focused and actionable. The recipient agent should be able to pick up the work without extra context. - If no namespace is configured, the MCP server will use the default. Do not ask the user for a namespace unless the publish fails.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The share command creates a temporary share token and preview URL, which are access-bearing secrets, but the command matrix does not warn that anyone with the tokenized URL may be able to access the artifact until expiry. In a file-sharing skill, this is especially relevant because users may copy tokens into chats, tickets, or logs without realizing they grant access.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The watch --exec ./script mode will execute a local program for each event, but the documentation does not prominently warn about the code-execution behavior or the risks of feeding untrusted event data into automation. In an agent-oriented skill, this is more dangerous because users are likely to wire it into unattended workflows where event-triggered execution can amplify mistakes or unsafe wrapper scripts.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The documentation includes a direct configuration command that places an API key on the command line without warning that shell history, process listings, logs, or transcripts may capture the secret. In a skill intended for agent runtimes and automation, that omission increases the chance that users or wrappers will handle long-lived credentials unsafely.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.