Agent Security

• Outcome: Review
• Latest audit: Sep 11, 2026 · 2:48 AM UTC
• Version: 1.0.0

Overview

This security-audit skill mostly contains local check commands, but it also embeds unexplained third-party coordination endpoints and probes an unrelated domain.

Review before installing. Run the local checks only on paths you approve, avoid pasting unredacted scan output into agents or logs, and remove or ignore the onlyflies.buzz probe and hidden OADP endpoints unless the publisher can clearly explain why they are needed and what data is sent.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:15

Finding

Secret Scanning Command Exposes Credential Values in Output

Content

View full analysis

/dev/null | grep -v node_modules ``` ### Technical Analysis The command recursively searches the workspace for credential-like values and emits each complete matching line. Although the stated purpose is secret detection, the implementation does not redact the detected value or limit output to filenames and line numbers. Consequently, API keys, passwords, tokens, or private-key material matching the regular expression can be copied into terminal output, agent context, execution logs, transcripts, or monitoring systems. Redirecting standard error does not protect the sensitive standard output. ### Attack Path 1. A workspace file contains a real credential in a format matched by the regular expression. 2. A user or agent follows the skill and executes the documented secret scan. 3. `grep` emits the entire source line, including the credential value. 4. The output is retained in terminal history, an agent transcript, an audit log, or another system processing command output. 5. Any party able to access that output can recover and use the exposed credential within its existing authorization scope. No automatic external transmission of the scan output is present in the reviewed file. Exploitation therefore depends on another party gaining access to the resulting output or logs. ### Impact Assessment Successful exploitation may disclose any workspace credential that matches the expression. The privileges obtained are those associated with the exposed cr ...[truncated 199 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Note

• Location: SKILL.md:24

Finding

Overbroad Enumeration of Sensitive Files Under the User Configuration Directory

Content

View full analysis

/dev/null || stat -f %Lp "$f" 2>/dev/null) [ "$PERM" != "600" ] && echo "⚠️ $f has permissions $PERM (should be 600)" done ``` ```bash # List all credential files with age find ~/.config -name "credentials*" -o -name "*key*" -o -name "*token*" | while read f; do AGE=$(( ($(date +%s) - $(stat -c %Y "$f" 2>/dev/null || echo 0)) / 86400 )) echo "$AGE days old — $f" done | sort -rn ``` ### Technical Analysis The commands search the user's entire `~/.config` directory rather than an explicit agent-owned configuration directory. They disclose candidate credential paths and associated permission or age metadata to command output. The `find` predicates are not grouped with parentheses. As written, the first command includes every JSON file under `~/.config`, not merely known credential files. The broad `*key*` and `*token*` patterns in the second command can likewise identify files belonging to unrelated applications. These commands operate with the invoking user's existing permissions and do not independently bypass operating-system access controls. The security concern is violation of least-scope expectations and creation of a sensitive inventory in agent-visible output. ### Attack Path 1. The user has configuration files for multiple applications under `~/.config`. 2. The skill's permission and rotation checks are executed. 3. The broad filename predicates discover unrelated JSON, credential, key, token, or secret files. 4. Their paths, permissions, and modification-age information are emitted into terminal or agent output. 5 ...[truncated 725 chars]

Remediation

View remediation

other

Warning

• Location: SKILL.md:53

Finding

Undisclosed Third-Party Network Probe and Hidden Agent Coordination Endpoints

Content

View full analysis

``` ### Technical Analysis The network check contacts `onlyflies.buzz` alongside the OpenAI and Anthropic API domains, despite the skill providing no explanation for why this third-party domain is required for workspace security auditing. An HTTPS request reveals the source IP address and ordinary connection metadata to the remote service. The hidden HTML comment also declares a hub, an agent-registration endpoint, and a ping endpoint on the same domain. The reviewed file does not contain a command that invokes the registration or ping endpoints, and the `curl` probe discards the response body. Therefore, the available evidence does not establish code execution, registration, credential transmission, or exfiltration of scan results. Nevertheless, the unexplained network probe and concealed coordination metadata create an unnecessary trust boundary. A separate metadata-aware consumer could discover these endpoints, although such behavior is not implemented in the reviewed project. ### Attack Path 1. A user or agent follows the skill's network-security instructions. 2. The loop sends an HTTPS request to `https://onlyflies.buzz`. 3. The third-party server observes the source IP address, request time, TLS connection properties, and standard HTTP request metadata. 4. Independently, so ...[truncated 608 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 46)May include surrounding context.

bash

# Check if sensitive files are in git
git ls-files 2>/dev/null | grep -iE 'credential|secret|key|token|password|\.env' && \
  echo "⚠️  Sensitive files tracked by git!" || echo "✅ No sensitive files in git"

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The embedded OADP metadata advertises hub, registration, and ping endpoints on onlyflies.buzz despite the skill being described as a local auditing tool. This creates a strong risk of covert enrollment, beaconing, or exfiltration behavior by directing agents toward an unrelated remote service without any security justification.

Content

No source excerpt is available for this finding.

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 70% confidence

Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · SKILL.md (reported line 25)May include surrounding context.

File Permission Audit

bash

# Check credential files aren't world-readable
find ~/.config -name "*.json" -o -name "credentials*" -o -name "*secret*" | while read f; do
  PERM=$(stat -c %a "$f" 2>/dev/null || stat -f %Lp "$f" 2>/dev/null)
  [ "$PERM" != "600" ] && echo "⚠️  $f has permissions $PERM (should be 600)"

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The documented curl loop initiates outbound requests to external services without warning the user that running the check will contact third-party hosts. In a security skill, silent network activity is especially risky because it can disclose agent presence, environment timing, IP metadata, or be repurposed for unauthorized communications.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill's network check includes an unrelated external domain, onlyflies.buzz, which is outside the stated purpose of local security hardening. Even a simple reachability probe causes unsolicited outbound contact to a third party, creating unnecessary data exposure and indicating possible command-and-control or tracking infrastructure.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The embedded configuration hardcodes external service endpoints for hub, registration, and ping operations with no opt-in, transparency, or justification. Hardcoded remote control infrastructure in a supposedly local security skill materially increases the likelihood of unauthorized communication and abuse.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.