T08 · Insecure Dependencies
Error
- Location
SKILL.md:23- Finding
Unpinned npm Package Is Downloaded and Executed Without Verification
- Content
View full analysis
- Remediation
View remediation
Security audit
autoglmasr
Security checks for vulnerabilities and agentic risk
Overview
This ASR skill is purpose-aligned but should go through Review because it runs an unpinned npm MCP server and sends local audio to an external transcription API.
Before installing, pin autoglm-asr-mcp to a reviewed exact version, consider running the MCP server in a restricted environment, use a dedicated API key, and only transcribe audio you are comfortable sending to the external Zhipu/BigModel ASR service.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 96% confidence
- Finding
The skill instructs users to run the MCP server via an unpinned
npx autoglm-asr-mcp, which fetches the latest package version at execution time. This creates a supply-chain risk: if the package is compromised, hijacked, or a malicious update is published, users may execute attacker-controlled code in their local environment with access to files, environment variables, and MCP-connected data.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill processes local audio files and sends their contents to an external ASR API, but the description does not clearly warn users that potentially sensitive audio leaves the local system. This can lead to unintended disclosure of confidential conversations, personal data, or regulated information, especially because the tool accepts arbitrary absolute file paths and is designed for bulk/long-audio transcription.
- Content