Security checks for vulnerabilities and agentic risk
Overview
This is a coherent TopoLift API integration, but it needs review because it can send sensitive negotiation details to a third-party service and installs an unpinned MCP package that receives an API key.
Review this before installing. Use it only for negotiation details you are allowed to send to TopoLift, redact counterpart identities and confidential strategy where possible, prefer a narrow and revocable API key, pin and verify the MCP package version, and require explicit approval or wallet limits before x402 paid calls.
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
T08 · Insecure Dependencies
Warning
Location
SKILL.md:60
Finding
Unpinned Third-Party MCP Package Installation
Content
View full analysis
Vulnerability Details
File Location: SKILL.md:60-64 Additional Location: README.md:30-34 Vulnerability Type: Unpinned executable dependency with access to an API credential Risk Level: Medium
The installation instructions retrieve and execute the latest version of the topolift-mcp package from PyPI without specifying an audited version or verifying a cryptographic hash. Consequently, the code that users execute can change after this Skill has been reviewed.
The installed package is then launched as an MCP server with access to TOPOLIFT_API_KEY. If the package publication account, build pipeline, or distribution artifact were compromised, a malicious release could execute code under the invoking user's account and read the supplied credential.
No evidence in the audited files establishes that the current package is malicious. The vulnerability is the mutable, unverified supply-chain trust relationship combined with credential exposure to the dependency.
Attack Path
An attacker compromises the package maintainer's PyPI account, release pipeline, or another component of the package supply chain.
The attacker publishes a malicious version of topolift-mcp.
A user follows the documented pip install topolift-mcp instruction, which selects the malicious release because no version or hash is pinned.
The user registers or launches the installed package as an MCP server.
The malicious package executes with the user's local process privileges and receives TOPOLIFT_API_KEY through its environment.
It can steal
...[truncated 722 chars]
Remediation
View remediation
Remediation Suggestions
Pin the package to a specifically reviewed version, for example:
bash
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content
Scanner excerpt · README.md (reported line 22)May include surrounding context.
Live dialect endpoint
bash
curl https://api.topolift.ai/v1/dialect
No auth. No rate limit. Returns the canonical vocabulary your agent needs.
External Transmission
Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content
Scanner excerpt · README.md (reported line 22)May include surrounding context.
Live dialect endpoint
bash
curl https://api.topolift.ai/v1/dialect
No auth. No rate limit. Returns the canonical vocabulary your agent needs.
External Transmission
Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content
Scanner excerpt · README.md (reported line 41)May include surrounding context.
Live dialect endpoint
bash
curl https://api.topolift.ai/v1/dialect
No auth. No rate limit. Returns the canonical vocabulary your agent needs.
External Transmission
Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content
Scanner excerpt · README.md (reported line 68)May include surrounding context.
Live dialect endpoint
bash
curl https://api.topolift.ai/v1/dialect
No auth. No rate limit. Returns the canonical vocabulary your agent needs.
External Transmission
Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content
Scanner excerpt · SKILL.md (reported line 48)May include surrounding context.
Live dialect endpoint
bash
curl https://api.topolift.ai/v1/dialect
No auth. No rate limit. Returns the canonical vocabulary your agent needs.
External Transmission
Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content
Scanner excerpt · SKILL.md (reported line 120)May include surrounding context.
Live dialect endpoint
bash
curl https://api.topolift.ai/v1/dialect
No auth. No rate limit. Returns the canonical vocabulary your agent needs.
External Transmission
Medium
Category
Data Exfiltration
Confidence
96% confidence
Finding
The skill describes POSTing negotiation data to TopoLift's API and receiving structured reasoning back, which necessarily transmits potentially sensitive user or business information off-platform. In a negotiation-assistant skill, this is materially risky because prompts may include pricing strategy, reservation values, counterpart identities, and other confidential deal terms.
Content
Scanner excerpt · SKILL.md (reported line 34)May include surrounding context.
md
## What TopoLift returns
Every call to `POST https://api.topolift.ai/v1/negotiate` returns a
**bilingual** response:
- A typed `topology` object: `regime`, `load_bearing_strategies[]`,
Missing User Warnings
Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding
The skill explicitly instructs agents to send negotiation scenarios, goals, reservation prices, and offers to a third-party API, but it does not warn that these fields may contain sensitive business, legal, or personal data. In an agent-skill context, this omission is dangerous because operators may treat the skill as a harmless formatter while it actually normalizes external transmission of confidential negotiation context.
Content
No source excerpt is available for this finding.
External Transmission
Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content
Scanner excerpt · SKILL.md (reported line 48)May include surrounding context.
Fetch the live, authoritative vocabulary at any time:
bash
curl https://api.topolift.ai/v1/dialect
No auth. No rate limit. The published grammar includes:
External Transmission
Medium
Category
Data Exfiltration
Confidence
97% confidence
Finding
The direct API example sends detailed negotiation inputs including goals, reservation price, aspiration price, current offer, and scenario text to a remote vendor endpoint. This is dangerous because it creates a clear path for confidential commercial strategy or personal financial data to leave the local environment without any accompanying safety notice, minimization guidance, or approval step.
Content
Scanner excerpt · SKILL.md (reported line 83)May include surrounding context.
