MagBox

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 6:00 PM UTC
• Version: 0.2.1

Overview

MagBox is a disclosed local file handoff server scoped to two directories, with clear warnings about unauthenticated network access and optional user-level service persistence.

Install MagBox only if you want a local browser-accessible inbox/outbox. Keep the default loopback binding unless you intentionally need LAN access, never place credentials or confidential files in the served folders, and treat the service templates as an explicit opt-in because they keep the unauthenticated file bridge running across sessions.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (19)

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

Keep the process running. Defaults are `~/Inbox`, `~/Outbox`, and loopback port
9900. The directories are created if absent. New directories are owner-only;
existing directory permissions are unchanged. Keep these folders dedicated to
non-sensitive handoffs and controlled by their local owner. Do not run as root.

On the same machine open:

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill exposes network-reachable file transfer behavior and relies on multiple environment variables, but it does not declare any explicit tool scope or permission boundaries. In an agent ecosystem, that omission can lead to over-broad execution assumptions, making it easier for the skill to access networking or environment-backed configuration without clear user review or policy enforcement.

Session Persistence

Medium

• Category: Rogue Agent

Content

mkdir -p "$HOME/.config/systemd/user"
cp templates/magbox.service "$HOME/.config/systemd/user/magbox.service"
systemctl --user daemon-reload
systemctl --user enable --now magbox.service
```

Stop: `systemctl --user stop magbox.service`.

• Confidence: 80% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

• Category: Rogue Agent

Content

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<!-- Edit both absolute paths. Run as a user LaunchAgent. See references/deploy.md.
     LAN opt-in: change MAGBOX_BIND to a specific private interface address.
     Optional MAGBOX_HOSTS lists client-facing DNS names, separated by commas.

• Confidence: 75% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

• Category: Rogue Agent

Content

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<!-- Edit both absolute paths. Run as a user LaunchAgent. See references/deploy.md.
     LAN opt-in: change MAGBOX_BIND to a specific private interface address.
     Optional MAGBOX_HOSTS lists client-facing DNS names, separated by commas.

• Confidence: 75% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

• Category: Rogue Agent

Content

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<!-- Edit both absolute paths. Run as a user LaunchAgent. See references/deploy.md.
     LAN opt-in: change MAGBOX_BIND to a specific private interface address.
     Optional MAGBOX_HOSTS lists client-facing DNS names, separated by commas.

• Confidence: 75% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

• Category: Rogue Agent

Content

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<!-- Edit both absolute paths. Run as a user LaunchAgent. See references/deploy.md.
     LAN opt-in: change MAGBOX_BIND to a specific private interface address.
     Optional MAGBOX_HOSTS lists client-facing DNS names, separated by commas.

• Confidence: 75% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

• Category: Rogue Agent

Content

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<!-- Edit both absolute paths. Run as a user LaunchAgent. See references/deploy.md.
     LAN opt-in: change MAGBOX_BIND to a specific private interface address.
     Optional MAGBOX_HOSTS lists client-facing DNS names, separated by commas.

• Confidence: 75% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

• Category: Rogue Agent

Content

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<!-- Edit both absolute paths. Run as a user LaunchAgent. See references/deploy.md.
     LAN opt-in: change MAGBOX_BIND to a specific private interface address.
     Optional MAGBOX_HOSTS lists client-facing DNS names, separated by commas.

• Confidence: 75% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

• Category: Rogue Agent

Content

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<!-- Edit both absolute paths. Run as a user LaunchAgent. See references/deploy.md.
     LAN opt-in: change MAGBOX_BIND to a specific private interface address.
     Optional MAGBOX_HOSTS lists client-facing DNS names, separated by commas.

• Confidence: 75% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

• Category: Rogue Agent

Content

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<!-- Edit both absolute paths. Run as a user LaunchAgent. See references/deploy.md.
     LAN opt-in: change MAGBOX_BIND to a specific private interface address.
     Optional MAGBOX_HOSTS lists client-facing DNS names, separated by commas.

• Confidence: 75% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

• Category: Rogue Agent

Content

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<!-- Edit both absolute paths. Run as a user LaunchAgent. See references/deploy.md.
     LAN opt-in: change MAGBOX_BIND to a specific private interface address.
     Optional MAGBOX_HOSTS lists client-facing DNS names, separated by commas.

• Confidence: 75% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

• Category: Rogue Agent

Content

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<!-- Edit both absolute paths. Run as a user LaunchAgent. See references/deploy.md.
     LAN opt-in: change MAGBOX_BIND to a specific private interface address.
     Optional MAGBOX_HOSTS lists client-facing DNS names, separated by commas.

• Confidence: 75% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

• Category: Rogue Agent

Content

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<!-- Edit both absolute paths. Run as a user LaunchAgent. See references/deploy.md.
     LAN opt-in: change MAGBOX_BIND to a specific private interface address.
     Optional MAGBOX_HOSTS lists client-facing DNS names, separated by commas.

• Confidence: 75% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

• Category: Rogue Agent

Content

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<!-- Edit both absolute paths. Run as a user LaunchAgent. See references/deploy.md.
     LAN opt-in: change MAGBOX_BIND to a specific private interface address.
     Optional MAGBOX_HOSTS lists client-facing DNS names, separated by commas.

• Confidence: 75% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

• Category: Rogue Agent

Content

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<!-- Edit both absolute paths. Run as a user LaunchAgent. See references/deploy.md.
     LAN opt-in: change MAGBOX_BIND to a specific private interface address.
     Optional MAGBOX_HOSTS lists client-facing DNS names, separated by commas.

• Confidence: 75% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

• Category: Rogue Agent

Content

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<!-- Edit both absolute paths. Run as a user LaunchAgent. See references/deploy.md.
     LAN opt-in: change MAGBOX_BIND to a specific private interface address.
     Optional MAGBOX_HOSTS lists client-facing DNS names, separated by commas.

• Confidence: 75% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

• Category: Rogue Agent

Content

LAN opt-in: change MAGBOX_BIND to a specific private interface address.
     Optional MAGBOX_HOSTS lists client-facing DNS names, separated by commas.
     0.0.0.0 listens on all IPv4 interfaces and also needs explicit MAGBOX_HOSTS. -->
<plist version="1.0"><dict>
  <key>Label</key><string>ai.magbox</string>
  <key>ProgramArguments</key><array>
    <string>/opt/homebrew/bin/node</string>

• Confidence: 80% confidence
• Finding: Beginning at the plist body, this template defines a macOS LaunchAgent that will execute a Node.js server automatically via RunAtLoad and KeepAlive. While likely intended for convenience, autorun persistence for a file-transfer service increases exposure because the service remains continuously available and could become a foothold if the backing server has weaknesses or if MAGBOX_BIND is changed from localhost to a LAN-facing address.

Natural-Language Policy Violations

Low

• Confidence: 87% confidence
• Finding: The rendered document sets `lang="en"`, which forces an English language context for the UI regardless of user preference. The file does not present this as an optional or user-selectable locale, and there is no documented region-specific justification in the code.

Static analysis

No suspicious patterns detected.