AgentPin

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 7:27 PM UTC
• Version: 1.0.0

Overview

This is a coherent AgentPin development guide with expected cryptographic identity examples and no hidden or destructive behavior in the inspected artifacts.

Installers should treat the npm and PyPI SDKs as external code: verify the package identity, pin versions for production or sensitive projects, and keep private keys and issued credentials in appropriately protected project locations.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:102
• Finding: Unpinned npm Dependency Installation## Vulnerability Details **File Location**: `SKILL.md`, line 102 **Vulnerability Type**: Unpinned third-party dependency installation **Risk Level**: Medium ### Vulnerable Code ```bash npm install agentpin ``` ### Technical Analysis The guide instructs users or AI agents to install the `agentpin` package from the npm registry without specifying an exact version, lockfile, integrity hash, or verified artifact. Consequently, the installed code can change after the Skill has been reviewed. npm packages can define lifecycle scripts that execute during installation. If the package registry account, package namespace, or a future release is compromised, following this instruction could execute attacker-controlled code. The audited project does not include the JavaScript SDK source, so the behavior and integrity of the downloaded package could not be independently verified. Network access is necessary for the documented optional online discovery functionality, but installing mutable external executable content is not necessary merely to provide an informational development guide. The instruction therefore introduces avoidable supply-chain risk. ### Attack Path 1. An attacker compromises the npm publisher account, package namespace, or release process for `agentpin`. 2. The attacker publishes a malicious package version or modifies package lifecycle behavior. 3. A user or AI agent follows the unpinned `npm install agentpin` instruction. 4. npm resolves the current compromised release because no exact reviewed version or integrity constraint is specified. 5. Malicious installation scripts or subsequently imported package code execute with the privileges of the user running npm. 6. The malicious code may access files, environment variables, credentials, or network resources available to that user. ### Impact Assessment Successful exploitation could result in arbitrary code execution under the installing user's account. The ...[truncated 327 chars]
• Remediation: ## Remediation Suggestions - Pin the dependency to an exact, reviewed version rather than resolving the latest release. - Provide and enforce a committed lockfile containing npm integrity metadata. - Document the verified official package identity and publisher. - Use `npm ci` for reproducible installation where a lockfile is available. - Disable lifecycle scripts with `--ignore-scripts` when they are not required. - Review the resolved package contents and transitive dependencies before approving updates. - Prefer vendored or locally auditable source when the Skill is used in sensitive environments.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:128
• Finding: Unpinned PyPI Dependency Installation## Vulnerability Details **File Location**: `SKILL.md`, line 128 **Vulnerability Type**: Unpinned third-party dependency installation **Risk Level**: Medium ### Vulnerable Code ```bash pip install agentpin ``` ### Technical Analysis The guide instructs users or AI agents to install the `agentpin` package from PyPI without an exact version, hash verification, constraints file, or locally reviewed artifact. The command therefore resolves mutable external content whose behavior may differ from the version described by the audited documentation. Python package installation may execute build-system or setup logic, particularly when a source distribution must be built. Even when installation itself does not execute malicious logic, importing the installed package can run attacker-controlled module initialization code. The Python SDK source is absent from the audited artifact, preventing independent verification of the downloaded implementation. This creates a supply-chain boundary that is broader than necessary for an informational Skill and allows future registry content to alter the effective code used by an agent or developer. ### Attack Path 1. An attacker compromises the PyPI publisher account, package namespace, build process, or release artifact for `agentpin`. 2. The attacker publishes a malicious release. 3. A user or AI agent executes the documented unpinned `pip install agentpin` command. 4. pip selects the compromised release because no reviewed version and artifact hash are enforced. 5. Attacker-controlled code executes during package building, installation, or later import. 6. That code accesses resources available to the Python environment and the invoking user. ### Impact Assessment Successful exploitation could provide arbitrary code execution with the permissions of the user running pip or importing the package. Potential exposure includes source repositories, virtual-environment data, environment var ...[truncated 253 chars]
• Remediation: ## Remediation Suggestions - Pin an exact reviewed package version. - Require hashes using a locked requirements file and `pip install --require-hashes`. - Prefer reviewed wheel artifacts and reject unexpected source distributions. - Document the verified PyPI project identity and publisher. - Audit direct and transitive dependencies before upgrading. - Install into an isolated, least-privileged virtual environment without unnecessary secrets. - Vendor or include auditable SDK source for high-assurance or offline deployments.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.