Security audit

Antom Copilot

Security checks across malware telemetry and agentic risk

Overview

This Antom reporting skill appears purpose-aligned, but it handles merchant and email credentials and sends the merchant token to a different API host than the documentation states.

Review before installing. Verify with Antom that antomaplusai.antom.com is an official endpoint before entering a merchant token, use a revocable least-privilege token and an app-specific SMTP password, restrict permissions on ~/antom/conf.json, and confirm report recipients and contents before sending email.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (16)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill declares no permissions while its documented behavior implies access to local files, environment data, network services, and writing reports to disk. This creates a transparency and consent gap: users and host systems cannot accurately evaluate or constrain what the skill will do before it handles merchant tokens, SMTP credentials, and outbound communications.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The skill is presented as a general Antom assistant and delegation layer, but the described workflow includes sensitive actions: reading merchant and SMTP secrets from local config, calling remote APIs, generating files, and emailing attachments. That mismatch can mislead users and reviewers about the true security boundary, increasing the chance that secrets are exposed or reports are sent externally without informed consent.

Vague Triggers

Medium

Confidence: 81% confidence
Finding: The description claims coverage for all Antom-related requirements, which is overly broad and does not constrain what user requests should trigger downstream actions. In a skill that can access merchant data and email infrastructure, broad invocation language raises the risk of accidental or overbroad activation for sensitive operations.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The user-facing statement says it can help with all Antom-related queries and operations, which lacks operational boundaries. In context, the skill handles authentication tokens and SMTP settings, so ambiguous capability claims can cause users to entrust it with actions beyond its intended safe scope.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The delegation rule says the assistant will automatically analyze intent and route requests without clear activation criteria. Because the delegated expert can pull merchant data, generate reports, and send emails, automatic intent-based routing increases the chance of unintended sensitive actions from ambiguous prompts.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The skill states it is 'automatically called by the antom_copilot main skill based on user intent' without defining narrow trigger boundaries, approval requirements, or exclusions. In a skill that can pull merchant data and send emailed reports with attachments, broad auto-invocation increases the chance of unintended data access or accidental report dispatch when user intent is ambiguous.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The send-report capability describes emailing reports, attachments, and executive summaries to recipients but does not prominently warn users that sensitive merchant performance data may be transmitted externally. Without an explicit warning and confirmation requirement, users or orchestrators may send confidential business data to the wrong address or to unintended recipients.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The skill instructs users to store merchant tokens and email credentials in a local JSON file, including plaintext password fields, but does not warn about secret handling risks or recommend secure storage practices. This can lead to credential exposure through weak file permissions, endpoint compromise, backups, logs, or accidental sharing of configuration files.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The script sends a sensitive credential (`merchantToken`) and business query data to a remote HTTPS endpoint without any user-facing disclosure, consent, or trust verification of the destination. In an agent/skill context, this can expose secrets or merchant data unexpectedly, especially if users assume the tool is local-only or if the endpoint is changed or abused.

Unpinned Dependencies

Low

Category: Supply Chain
Content: # Payment Success Rate Expert - Python Dependencies # 能力一：query_antom_psr_data.py requests>=2.25.0 # 能力二：analyse_and_gen_report.py matplotlib>=3.3.0
Confidence: 91% confidence
Finding: Using an open-ended dependency specifier like requests>=2.25.0 allows future installs to resolve to different versions over time, which weakens reproducibility and can unintentionally pull in insecure or incompatible releases. In this skill, the risk is heightened because this package also has known advisories, so lack of pinning makes it harder to ensure a safe version is consistently deployed.

Unpinned Dependencies

Low

Category: Supply Chain
Content: requests>=2.25.0 # 能力二：analyse_and_gen_report.py matplotlib>=3.3.0 reportlab>=3.6.0 numpy>=1.19.0
Confidence: 88% confidence
Finding: matplotlib>=3.3.0 is not reproducible and permits environment-dependent resolution, which can introduce supply-chain and stability risk. While this is usually an indirect security issue rather than an immediately exploitable flaw, pinning is important for controlled builds and incident response.

Unpinned Dependencies

Low

Category: Supply Chain
Content: # 能力二：analyse_and_gen_report.py matplotlib>=3.3.0 reportlab>=3.6.0 numpy>=1.19.0 # 能力三：send_psr_report.py
Confidence: 96% confidence
Finding: reportlab>=3.6.0 permits any newer version and does not guarantee the installed package is free of known dangerous parser and rendering flaws. Given reportlab's history of critical issues including RCE/SSRF classes, unpinned installation materially increases the chance of deploying a vulnerable build or losing track of what is installed.

Unpinned Dependencies

Low

Category: Supply Chain
Content: # 能力二：analyse_and_gen_report.py matplotlib>=3.3.0 reportlab>=3.6.0 numpy>=1.19.0 # 能力三：send_psr_report.py # 仅使用Python标准库，无需额外依赖
Confidence: 87% confidence
Finding: numpy>=1.19.0 is an open-ended requirement that undermines deterministic builds and may introduce vulnerable or incompatible versions depending on install time and platform. The risk is contextual and often lower than direct network-facing libraries, but it still weakens supply-chain control.

Known Vulnerable Dependency: requests — 10 advisory(ies): CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +7 more

High

Category: Supply Chain
Confidence: 94% confidence
Finding: The requirements file allows installation of requests versions associated with multiple advisories, and the current specifier does not exclude vulnerable releases. In a skill that likely performs API calls for payment success-rate data, flaws in HTTP handling, credential leakage, or TLS/session behavior can expose secrets or compromise outbound requests.

Known Vulnerable Dependency: reportlab — 6 advisory(ies): CVE-2023-33733 (Reportlab vulnerable to remote code execution); CVE-2020-28463 (Server-side Request Forgery (SSRF) via img tags in reportlab); CVE-2019-19450 (ReportLab vulnerable to remote code execution via paraparser) +3 more

Critical

Category: Supply Chain
Confidence: 98% confidence
Finding: reportlab has a history of severe vulnerabilities including remote code execution and SSRF, and this dependency is used in report generation functionality where attacker-controlled content may plausibly enter templates, text, or embedded resources. In this context, a vulnerable PDF/report-generation component can turn externally influenced report data into code execution or unauthorized network access on the host.

Known Vulnerable Dependency: numpy — 10 advisory(ies): CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +7 more

Critical

Category: Supply Chain
Confidence: 82% confidence
Finding: The numpy dependency is flagged for multiple advisories, and the permissive version specifier does not ensure vulnerable releases are excluded. In this skill's apparent analytics/reporting context, numpy is less likely to be directly exposed to attacker input than network or document-parsing libraries, so the practical exploitability is lower, but vulnerable native-code packages still present risk in shared or automated environments.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.