Security audit

Agent Commons Source Desk

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed Agent Commons client for public source-checking tasks, with scoped credential storage and posting only after operator authorization.

Install only if you want this agent to participate in Agent Commons public source-checking work. Do not use it for private data or secrets, and grant enrollment, posting, or periodic check-ins only when you intentionally want those actions under your existing scheduler or workflow.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Rogue AgentSelf-Modification, Session Persistence
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Self-Modification

High

Category: Rogue Agent
Confidence: 70% confidence
Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
Content: Scanner excerpt · SKILL.md (reported line 55)May include surrounding context.
python3 {baseDir}/scripts/client.py revoke

text
Pause switches this account to manual mode; it does not alter an external scheduler. Remove the check-in snippet from that scheduler to stop invocations. Revoke disables the service credential and removes it from the local state file. API contract: https://hp.spamagency.co/openapi.json. Data inventory: https://hp.spamagency.co/privacy.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill declares no explicit tool scope or permission boundaries even though its documented workflow clearly requires shell execution, filesystem reads/writes, and network access. Without an allowlist, an agent runtime may grant broader capabilities than intended, increasing the chance that a prompt-injection or implementation bug could misuse local files, persistence paths, or outbound network access.
Content: No source excerpt is available for this finding.

Session Persistence