Security audit

Agent Sentinel

Security checks for vulnerabilities and agentic risk

Overview

The scanner’s main command is local and purpose-aligned, but the package uses an unpinned remote install path and includes a verifier that can execute untrusted candidate code.

Install only if you use the packaged audited file or a pinned, verified release instead of the curl-from-main command, and do not run ci/verify_product.py against third-party skills except inside a disposable sandbox with no secrets or sensitive filesystem access. The main agent_sentinel.py scan path is local and does not show telemetry, but the surrounding package needs careful handling.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Warning

Location: README.md:34
Finding: Mutable Remote Python Payload Downloaded Without Integrity Verification
Content: View full analysis
Remediation: View remediation
/agent_sentinel.py printf '%s %s\n' '' agent_sentinel.py | sha256sum --check - ``` 6. Advise users to inspect the verified file before running it and to execute it as an unprivileged user. 7. Keep `README.md` and `SKILL.md` installation instructions synchronized so both use the hardened process. ]]>

T09 · Insecure Skill Coding Practices

Error

Location: ci/verify_product.py:39
Finding: Verification Harness Executes Untrusted Candidate Python Files
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (7)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: If the tool executes Python files or subprocess-based self-tests while presenting itself as a passive pre-install scanner, it materially changes the risk model from analysis to code execution. In the context of vetting untrusted third-party skills, executing components during validation can expose the user or CI runner to malicious code while also failing to deliver the promised permission-risk review.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: If the tool executes Python files or subprocess-based self-tests while presenting itself as a passive pre-install scanner, it materially changes the risk model from analysis to code execution. In the context of vetting untrusted third-party skills, executing components during validation can expose the user or CI runner to malicious code while also failing to deliver the promised permission-risk review.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 75% confidence
Finding: The skill advertises local/offline scanning behavior and installation instructions that fetch and run a Python script, but the manifest shown in SKILL.md does not declare any explicit tool scope or permissions. When a skill appears to require sensitive capabilities such as file access, network retrieval, or shell execution without clearly declaring them, users and automated policy systems cannot accurately assess the trust boundary before installation.
Content: No source excerpt is available for this finding.

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 97% confidence
Finding: This code executes arbitrary Python files from the target product folder using python <file> self-test, which means verification of an untrusted skill will run attacker-controlled code on the host. In a CI or pre-install scanning context, that defeats the purpose of safe inspection and can lead to remote code execution, data exfiltration, or environment compromise.
Content: Scanner excerpt · ci/verify_product.py (reported line 37)May include surrounding context.
python
def has_self_test(fp): r = subprocess.run([sys.executable, fp, "self-test"], capture_output=True, text=True, timeout=30) return r.returncode == 0 and "PASS" in r.stdout

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · ci/verify_product.py (reported line 67)May include surrounding context.
python
all_ok &= axis(False, "frontmatter (no SKILL.md)") all_ok &= axis(False, "docs (no SKILL.md)") # 3 compiles comp_ok = all(subprocess.run([sys.executable, "-m", "py_compile", fp], capture_output=True).returncode == 0 for fp in files) all_ok &= axis(comp_ok, "compiles (py_compile all .py)") # 4 self-test (any of 3 valid forms)

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 98% confidence
Finding: This code directly executes any test_*.py or *_test.py file found in the scanned product folder. Because those tests are supplied by the untrusted skill author, a malicious skill can embed arbitrary code in a test file and gain execution during the verification phase, especially dangerous in CI where credentials and repository access may exist.
Content: Scanner excerpt · ci/verify_product.py (reported line 79)May include surrounding context.
python
tests = [os.path.join(folder, f) for f in os.listdir(folder) if (f.startswith("test_") or f.endswith("_test.py")) and f.endswith(".py")] if tests: st_ok = all(subprocess.run([sys.executable, t], capture_output=True, text=True, timeout=30).returncode == 0 for t in tests) st_note = f"{len(tests)} test_*.py" elif re.search(r"(?im)^test\s*:", skill_txt):

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · ci/verify_product.py (reported line 92)May include surrounding context.
python
# 7 deploy-ready ci = os.path.join(os.path.dirname(os.path.abspath(__file__)), "ci_check.py") if os.path.isfile(ci) and os.path.isfile(skill): r = subprocess.run([sys.executable, ci], cwd=folder, capture_output=True, text=True) all_ok &= axis(r.returncode == 0, "deploy-ready (ci/ci_check.py PASS)") else: all_ok &= axis(True, "deploy-ready (skipped)")