Letta

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 9:29 AM UTC
• Version: 1.0.0

Overview

This is a mostly informational Letta helper; its main caveat is a user-run global npm install command that should be treated like installing software.

Install this only if you intend to use Letta. Before running the npm command, consider pinning a reviewed version, avoiding sudo or administrator shells, and verifying the package source because a global npm install can execute package code and add persistent CLI binaries.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:20

Finding

Unpinned Global npm Package Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 20-23
Vulnerability Type: Unpinned third-party dependency installed globally
Risk Level: Medium

Code Snippet:

markdown

- **Letta Code** — run agents locally in your terminal (requires Node.js 18+)
  ```bash
  npm install -g @letta-ai/letta-code
  ```

Technical Analysis

The documented command installs @letta-ai/letta-code without specifying an exact version. npm therefore resolves the package through a mutable distribution tag, normally latest, meaning that the code installed by a future user may differ from the code available when this skill was audited.

The -g option installs the package globally. Depending on the npm configuration and how the command is invoked, package binaries become available system-wide or throughout the user's environment. npm installation can also run package lifecycle scripts unless those scripts are explicitly disabled. Consequently, compromise of the package, its release process, registry account, or transitive dependency could result in attacker-controlled code executing during installation.

The project does not include a lockfile, integrity value, package source validation, or a reviewed local copy of the dependency. This finding does not establish that the named package is malicious; it identifies an unsafe and mutable supply-chain installation procedure.

Attack Path

1. An attacker compromises the npm package, a maintainer account, the package publication pipeline, or a transitive dependency.
2. The attacker publishes a malicious release under the distribution tag resolved by the unpinned command.
3. A user follows the skill documentation and runs npm install -g @letta-ai/letta-code.
4. npm downloads the mutable release and may execute attacker-controlled lifecycle scripts during installation.
5. The malicious package executes with the installing user's privileges and can expose a globally ...[truncated 795 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the package to a reviewed exact version rather than relying on a mutable distribution tag:

   bash

   npm install @letta-ai/letta-code@<audited-exact-version>
   

2. Prefer a project-local dependency recorded in package.json and a committed lockfile over a global installation.
3. Use npm ci with a reviewed lockfile in reproducible or automated environments.
4. Verify package provenance, publisher identity, registry source, and integrity metadata before installation.
5. Disable lifecycle scripts with --ignore-scripts when the package functions correctly without them; otherwise, audit all required installation scripts.
6. Run the installation as an unprivileged user and explicitly warn users not to invoke it with sudo or an administrator shell.
7. Periodically review the pinned release and its transitive dependency tree before performing controlled upgrades.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The activation trigger is overly broad: phrases like 'AI agents with memory' or 'persistent context' are common in general AI discussions, so the skill may be invoked outside its intended scope. This can cause inappropriate routing, unnecessary tool influence, or accidental disclosure of the skill’s guidance in unrelated conversations, especially in an agent platform that auto-selects skills based on prompt matching.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

Line 14 introduces Chinese-language content in an otherwise English skill description, without indicating that the user can choose the language or that the skill is intended for a Chinese-speaking context. This can violate language/locale expectations by imposing a locale choice implicitly.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.