Security audit

Lazaretto

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent security-checking skill, but it has review-worthy risks around configurable API endpoints, API-key forwarding, inline file upload, and weak local verification boundaries.

Install only if you are comfortable with scans contacting a remote service. Avoid setting LAZARETTO_API or using --api unless you fully trust that exact endpoint, do not pass an API key to custom endpoints, and treat inline scans as uploading the selected file. Use the verify command as a helpful signal, not a byte-perfect guarantee, especially for binary files or directories that may contain symlinks.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

Location: lazaretto-verify.mjs:98
Finding: API credentials and inline scan content can be sent to an attacker-controlled endpoint
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: lazaretto-verify.mjs:39
Finding: Lossy UTF-8 conversion prevents byte-accurate artifact verification
Content: View full analysis
`${f.path}\n${sha256Hex(Buffer.from(f.content, 'utf8'))}`) .sort(); return 'sha256:' + sha256Hex(Buffer.from(lines.join('\n') + '\n', 'utf8')); } ``` ```js else if (st.isFile()) out.push({ path: childRel, content: readFileSync(childAbs, 'utf8') }); ``` ```js return canonicalArtifactHash([{ path: path.basename(target), content: readFileSync(target, 'utf8') }]); ``` ### Technical Analysis Files are read as UTF-8 strings and then converted back into UTF-8 buffers before hashing. This transformation is not byte-preserving for arbitrary files. Invalid UTF-8 byte sequences are decoded into replacement characters, and distinct invalid byte sequences can therefore be normalized into the same JavaScript string. The resulting SHA-256 operation authenticates the normalized text representation rather than the original bytes on disk. This contradicts the documented objective of verifying that the installed bytes exactly match the scanned artifact. The issue is particularly relevant to binaries, archives, images, generated files, and intentionally malformed text. SHA-256 itself is not broken; the collision is introduced before hashing by lossy decoding. ### Attack Path 1. An attacker prepares a scanned file containing a particular invalid UTF-8 byte sequence. 2. The attacker prepares a byte-distinct replacement file whose invalid byte sequence decodes to the same JavaScript string. 3. The legitimate and replacement files are read with `readFileSync(..., 'utf8')`. 4. Node.js replaces the distinct malformed sequences with the same Unicode replacement representation. 5. Bo ...[truncated 663 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: lazaretto-verify.mjs:53
Finding: Directory verification follows untrusted symbolic links outside the artifact tree
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 20)May include surrounding context.
md
you can audit it in full (`lazaretto-verify.mjs` is dependency-free Node built-ins

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The top-level documentation says the skill 'touches no credentials beyond an optional API key you pass it,' implying configuration is provided explicitly by the caller. However, the code also reads process.env.LAZARETTO_API to source the API endpoint, which is an additional environment access not described by the comment. This is a mild but real documentation-to-code divergence.
Content: No source excerpt is available for this finding.