Agent Health

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:14 AM UTC
• Version: 2.0.1

Overview

The bundled health-check tool is mostly coherent, but its install instructions tell users to download and run mutable remote Python code that was not pinned or verified.

Review before installing. Prefer the bundled agent_health.py or a pinned, checksummed release instead of the documented curl-from-main command. Run it with least privilege, probe only endpoints you control or are authorized to test, and avoid running the included CI verifier on untrusted folders unless sandboxed.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (2)

T03 · Remote Payload Retrieval and Execution

Warning

• Location: README.md:32

Finding

Mutable Remote Python Payload Downloaded and Subsequently Executed

Content

View full analysis

Vulnerability Details

File Location: README.md:32-44
Vulnerability Type: Unpinned remote payload retrieval and execution
Risk Level: Medium

The installation and quick-start instructions contain the following complete relevant code segment:

bash

## Install

# Requires Python 3.8+. No pip install needed.
curl -O https://raw.githubusercontent.com/itsPremkumar/agent-health/main/agent_health.py
# Or copy the file anywhere — it's self-contained.

## Quick start

python agent_health.py self-test     # prove it works end-to-end
python agent_health.py check --help   # check subcommand

Technical Analysis

The documentation instructs users to download executable Python code from the mutable main branch of a personal GitHub repository and then execute the resulting file. The URL is not pinned to an immutable commit or release, and the instructions provide no checksum or signature verification.

Consequently, the code executed by a user can differ from the code reviewed in this package. HTTPS protects the connection in transit but does not protect against repository compromise, maintainer-account takeover, malicious upstream changes, or unauthorized modification of the branch.

Remote retrieval is unnecessary for the packaged Skill because an auditable copy of agent_health.py is already included. The instruction therefore exceeds the minimum behavior necessary to use the distributed package.

Attack Path

1. An attacker compromises the upstream repository, the maintainer account, or another mechanism capable of modifying main/agent_health.py.
2. The attacker replaces the upstream file with a malicious Python payload.
3. A user or automated Agent follows the documented curl -O installation instruction.
4. The mutable remote payload is saved locally as agent_health.py.
5. The user follows the adjacent quick-start instructions and runs the downloaded file with Python.
6. The payload exe ...[truncated 830 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the remote download instruction and direct users to execute the bundled, reviewed agent_health.py.
2. If remote distribution is required, use an immutable URL pinned to a reviewed commit rather than the mutable main branch.
3. Publish an expected SHA-256 digest through a separately protected release channel and require verification before execution.
4. Prefer signed release artifacts and document signature verification.
5. Harden retrieval with options such as curl --fail --location --proto '=https'.
6. Do not place execution instructions immediately after an unverified download.
7. Run the utility as an unprivileged account with only the filesystem and network access needed to probe approved endpoints.

T03 · Remote Payload Retrieval and Execution

Warning

• Location: SKILL.md:30

Finding

Skill Instructions Retrieve an Unverified Mutable Executable

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:30-42
Vulnerability Type: Unpinned remote payload retrieval and execution
Risk Level: Medium

The Skill instructions contain the following complete relevant code segment:

bash

## Install

# Requires Python 3.8+. No pip install needed.
curl -O https://raw.githubusercontent.com/itsPremkumar/agent-health/main/agent_health.py
# Or copy the file anywhere — it's self-contained.

## Quick start

python agent_health.py self-test     # prove it works end-to-end
python agent_health.py check --help   # check subcommand

Technical Analysis

The Skill directs users or Agents to retrieve executable Python source from the mutable main branch of a personal repository. No immutable commit identifier, cryptographic checksum, or signature is supplied. The downloaded file is then executed by the documented quick-start commands.

This creates a time-of-review versus time-of-use discrepancy: the locally audited agent_health.py can be benign while the remotely retrieved file changes later. An Agent following the Skill instructions could therefore execute code that was never included in or reviewed with the Skill package.

The behavior is not required for endpoint monitoring because the package already ships the executable file. Using the bundled copy would satisfy the declared functionality without introducing an additional remote code trust boundary.

Attack Path

1. An attacker gains the ability to modify the upstream main branch through account compromise, repository compromise, or a malicious upstream update.
2. The attacker inserts arbitrary Python code into the remotely hosted agent_health.py.
3. A user or Agent follows the installation command in SKILL.md.
4. curl downloads the attacker-controlled version without validating its identity or integrity.
5. The subsequent quick-start command invokes Python on the downloaded file.
6. The maliciou ...[truncated 702 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the download-based installation step with instructions to use the agent_health.py included in the Skill package.
2. If downloading remains necessary, pin the artifact to a reviewed commit or immutable signed release.
3. Provide and verify a cryptographic digest before invoking Python.
4. Protect release signing keys separately from the source-hosting account.
5. Fail safely on download errors and restrict retrieval to HTTPS with curl --fail --location --proto '=https'.
6. Clearly warn Agents not to execute remotely retrieved code until its integrity and provenance have been verified.
7. Execute the monitor under a least-privileged account with narrowly scoped filesystem, credential, and network access.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence

Finding

A health-monitoring skill that instead verifies repositories, scans files for secrets, and compiles or executes local Python via subprocess materially exceeds its advertised role. That combination can lead to unintended code execution and sensitive data exposure in environments where users expected only passive endpoint probing.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

A health-monitoring skill that instead verifies repositories, scans files for secrets, and compiles or executes local Python via subprocess materially exceeds its advertised role. That combination can lead to unintended code execution and sensitive data exposure in environments where users expected only passive endpoint probing.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

A health-monitoring skill that instead verifies repositories, scans files for secrets, and compiles or executes local Python via subprocess materially exceeds its advertised role. That combination can lead to unintended code execution and sensitive data exposure in environments where users expected only passive endpoint probing.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill advertises executable usage that reads local files, performs network probes, and can be run from CI, but it does not declare any explicit tool scope or permissions boundary in the skill metadata. Missing scope makes the behavior less auditable and can cause an agent runner to grant broader capabilities than a user expects, especially for network and shell-adjacent execution.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 97% confidence

Finding

This function executes an arbitrary Python file from the target product directory as part of verification. In a CI or shared automation context, a malicious contributor can place hostile code in a product .py file and have it run automatically during the self-test check, resulting in arbitrary code execution with the privileges of the verifier.

Content

Scanner excerpt · ci/verify_product.py (reported line 37)May include surrounding context.

python

def has_self_test(fp):
    r = subprocess.run([sys.executable, fp, "self-test"], capture_output=True, text=True, timeout=30)
    return r.returncode == 0 and "PASS" in r.stdout

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · ci/verify_product.py (reported line 67)May include surrounding context.

python

all_ok &= axis(False, "frontmatter (no SKILL.md)")
        all_ok &= axis(False, "docs (no SKILL.md)")
    # 3 compiles
    comp_ok = all(subprocess.run([sys.executable, "-m", "py_compile", fp],
                                capture_output=True).returncode == 0 for fp in files)
    all_ok &= axis(comp_ok, "compiles (py_compile all .py)")
    # 4 self-test (any of 3 valid forms)

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 98% confidence

Finding

This code directly executes any test_*.py or *_test.py file found in the target folder. In the context of verifying third-party agent skills, that means untrusted repository content is executed automatically, enabling arbitrary code execution, secret exfiltration, filesystem modification, or network access during CI validation.

Content

Scanner excerpt · ci/verify_product.py (reported line 79)May include surrounding context.

python

tests = [os.path.join(folder, f) for f in os.listdir(folder)
                 if (f.startswith("test_") or f.endswith("_test.py")) and f.endswith(".py")]
        if tests:
            st_ok = all(subprocess.run([sys.executable, t], capture_output=True, text=True,
                                      timeout=30).returncode == 0 for t in tests)
            st_note = f"{len(tests)} test_*.py"
        elif re.search(r"(?im)^test\s*:", skill_txt):

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · ci/verify_product.py (reported line 92)May include surrounding context.

python

# 7 deploy-ready
    ci = os.path.join(os.path.dirname(os.path.abspath(__file__)), "ci_check.py")
    if os.path.isfile(ci) and os.path.isfile(skill):
        r = subprocess.run([sys.executable, ci], cwd=folder, capture_output=True, text=True)
        all_ok &= axis(r.returncode == 0, "deploy-ready (ci/ci_check.py PASS)")
    else:
        all_ok &= axis(True, "deploy-ready (skipped)")

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill describes health checks but does not prominently warn that using it will actively send network requests to configured endpoints. In sensitive internal environments, even benign probes can trigger alerts, interact with production services, or violate user expectations if outbound activity is not clearly disclosed.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This code performs outbound HTTP requests to every URL listed in the input file, which can transmit system/network metadata to external services. Although the module docstring says it 'probes' endpoints, the execution path itself provides no confirmation prompt or runtime warning before contacting those hosts.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.