Security audit

lessie

Security checks for vulnerabilities and agentic risk

Overview

This skill is purpose-aligned, but needs review because it can auto-install unpinned npm packages, use a remote service for personal contact data, and fall back to broad remote tool calls.

Review before installing. Use this only when you intentionally want a remote people/company enrichment service, understand that searches may be logged and credits may be spent, and have a lawful basis for using retrieved contact data. Prefer explicit manual installation with pinned package versions, avoid automatic global installs or unpinned `npx -y`, and do not let the agent interpolate raw user or web text into shell commands.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

Location: SKILL.md:25
Finding: Automatic Execution of Unpinned npm Packages
Content: View full analysis
Vulnerability Details

File Location: SKILL.md:25-31, SKILL.md:59-61, SKILL.md:76-80, README.md:119-128
Vulnerability Type: Unpinned third-party dependency installation and execution
Risk Level: High

Vulnerable Code

SKILL.md:25-31:

bash
npm install -g @lessie/cli

Or use without installing:

bash
npx @lessie/cli --version

SKILL.md:59-61:

json
"command": "npx", "args": ["-y", "@lessie/mcp-server"]

SKILL.md:76-80:

text
1. Check if `lessie` CLI is available: run `lessie status` 2. If the command succeeds → use **CLI mode** (call tools via Bash) 3. If the command fails (not found) → attempt auto-install: `npm install -g @lessie/cli` 4. After install, run `lessie status` again to verify 5. If install succeeds → use **CLI mode**

README.md:119-128:

json
{ "mcpServers": { "lessie": { "command": "npx", "args": ["-y", "@lessie/mcp-server"], "env": { "LESSIE_REMOTE_MCP_URL": "https://app.lessie.ai/mcp-server/mcp" } } } }

Technical Analysis

The Skill installs and executes @lessie/cli and @lessie/mcp-server without pinning an exact reviewed version or verifying package integrity. The mode-detection instructions additionally direct the agent to perform a global npm installation automatically when lessie status fails.

npm install -g and npx -y can execute package code and lifecycle scripts with the permissions of the user running the agent. Because package versions are not fixed, the effective code executed can change after the Skill itself has been reviewed. A compromised publisher account, malicious package release, registry compromise, or compromised transitive dependency could consequently introduce arbitrary local code execution.

The behavior is related to the declared functionality because a Lessie client is required, but automatic global installati ...[truncated 1416 chars]
Remediation: View remediation
Remediation Suggestions

Pin every executable package to an exact reviewed version, for example @lessie/cli@2.1.0, rather than using an unconstrained package name.

Verify package integrity using a lockfile, trusted digest, signed provenance, or another reproducible verification mechanism.

Remove automatic installation from mode detection. If the CLI is missing, explain the required installation and obtain explicit user approval before changing the system.

Avoid global installation where possible. Install into a dedicated, least-privileged project directory or isolated environment.

Replace npx -y with a pinned, preinstalled executable. Do not automatically accept and execute an unknown current registry version.

Run the CLI or MCP server in a sandbox with restricted filesystem, credential, and network access.

Document the package version and expected publisher or integrity information so users can verify what will execute.

T09 · Insecure Skill Coding Practices

Error

Location: references/cli-reference.md:5
Finding: Shell Command Injection Through Unescaped User-Controlled Arguments
Content: View full analysis
Vulnerability Details

File Location: references/cli-reference.md:5-40, references/workflow-patterns.md:8-18, references/workflow-patterns.md:34-36, references/workflow-patterns.md:55-57
Vulnerability Type: Unsafe construction of shell commands from user-controlled or web-derived values
Risk Level: High

Vulnerable Code

references/cli-reference.md:5-40:

bash
# Search people lessie find-people \ --filter '{"person_titles":["CTO"],"person_locations":["US"]}' \ --checkpoint 'CTOs at AI startups in the US' \ --strategy hybrid \ --target-count 20 # Enrich people lessie enrich-people \ --people '[{"first_name":"Sam","last_name":"Altman","domain":"openai.com"}]' # Review people (from a previous search) lessie review-people \ --search-id 'mcp_xxx' \ --person-ids '["id1","id2"]' \ --checkpoints '[{"key":"Relevance","description":"...","title":"Relevance","category":"career"}]' # Find organizations lessie find-orgs \ --keyword-tags '["AI","SaaS"]' \ --locations '["China"]' \ --employees '["51,200"]' # Enrich organization lessie enrich-org --domains '["stripe.com"]' # Job postings (needs org ID from enrich/search) lessie job-postings --org-id '5f5e100...' # Company news lessie company-news --org-ids '["5f5e100..."]' # Web search lessie web-search --query 'OpenAI official website' --count 5 # Web fetch lessie web-fetch --url 'https://example.com' --instruction 'Extract job title and company'

references/workflow-patterns.md:8-18:

bash
# Step 1: Find domain lessie web-search --query 'CompanyName official website' --count 3 # Step 2: Verify domain lessie enrich-org --domains '["candidate.com"]' # Step 3: Search people with verified domain lessie find-people \ --filter '{"person_titles":["CTO"]}' \ --checkpoint 'CTOs at CompanyName' \ --domain '["verified_domain.com"]'

`references/workflow-patter ...[truncated 2748 chars]
Remediation: View remediation
Remediation Suggestions

Prefer MCP structured tool calls or a process API that accepts an executable and argument array without invoking a shell.

Prohibit direct concatenation or interpolation of user-controlled and web-derived values into Bash command strings.

If shell execution is unavoidable, apply a trusted shell-escaping routine independently to every dynamic argument. Do not implement escaping with ad hoc quote replacement.

Construct JSON with a real JSON serializer, then pass the serialized result as one argument through a non-shell process API.

Validate domains and URLs against strict expected formats and reject control characters, newlines, NUL bytes, and unexpected schemes.

Treat names, checkpoints, instructions, tool arguments, and search-derived URLs as untrusted input even when they appear benign.

Update every example to show safe structured invocation and add an explicit rule that agents must never place raw input in shell commands.

Run command-line tools in a least-privileged sandbox to limit the effect of any residual injection vulnerability.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (25)

MCP Config Access

High

Category: Agent Snooping
Confidence: 95% confidence
Finding: Skill accesses MCP server configuration files (mcp.json). MCP configs contain server URLs, authentication tokens, and tool definitions — reading them allows the skill to discover and potentially abuse other tool integrations.
Content: Scanner excerpt · README.md (reported line 111)May include surrounding context.
md
| Client | Config file | |--------|-------------| | Claude Code | `~/.claude/mcp.json` | | Cursor | `~/.cursor/mcp.json` | | Codex | `~/.codex/config.json` |

Agent Config Directory Access

High

Category: Agent Snooping
Confidence: 90% confidence
Finding: Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.
Content: Scanner excerpt · README.md (reported line 113)May include surrounding context.
|--------|-------------| | Claude Code | ~/.claude/mcp.json | | Cursor | ~/.cursor/mcp.json | | Codex | ~/.codex/config.json |

json
{

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · README.md (reported line 131)May include surrounding context.
md
### Uninstall - **CLI + Skill:** `npm uninstall -g @lessie/cli && rm -rf ~/.lessie/ ~/.claude/skills/lessie` - **MCP:** Remove the `"lessie"` entry from your MCP config and `rm -rf ~/.lessie/` - **Codex:** `rm -rf ~/.codex/skills/lessie` (or `.agents/skills/lessie`)

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 90% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · README.md (reported line 131)May include surrounding context.
md
### Uninstall - **CLI + Skill:** `npm uninstall -g @lessie/cli && rm -rf ~/.lessie/ ~/.claude/skills/lessie` - **MCP:** Remove the `"lessie"` entry from your MCP config and `rm -rf ~/.lessie/` - **Codex:** `rm -rf ~/.codex/skills/lessie` (or `.agents/skills/lessie`)

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · README.md (reported line 133)May include surrounding context.
md
- **CLI + Skill:** `npm uninstall -g @lessie/cli && rm -rf ~/.lessie/ ~/.claude/skills/lessie` - **MCP:** Remove the `"lessie"` entry from your MCP config and `rm -rf ~/.lessie/` - **Codex:** `rm -rf ~/.codex/skills/lessie` (or `.agents/skills/lessie`) ## Tools

Agent Config Directory Access

High

Category: Agent Snooping
Confidence: 85% confidence
Finding: Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.
Content: Scanner excerpt · README.md (reported line 195)May include surrounding context.
Use /lessie for all people search, contact enrichment, company research, and sourcing tasks.

text
**Codex can't find the skill?** Check that `SKILL.md` exists at `.agents/skills/lessie/SKILL.md` or `~/.codex/skills/lessie/SKILL.md` ## Links

Vague Triggers

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The activation instructions are extremely broad and tell the agent to trigger on common phrases like finding contacts, prospecting, or business intelligence, even when the user does not explicitly request this skill. Over-broad activation increases the chance the agent will invoke external tooling, send user queries to a third-party service, and initiate browser auth or installation in situations where the user expected only local reasoning.
Content: No source excerpt is available for this finding.

MCP Config Access

High

Category: Agent Snooping
Confidence: 95% confidence
Finding: The skill explicitly directs modification of local MCP configuration files such as ~/.claude/mcp.json and ~/.cursor/mcp.json. In an agent setting, instructions to read or alter local config can expose sensitive local state, persist untrusted tool definitions, or weaken the boundary between conversation-time actions and host-level configuration changes.
Content: Scanner excerpt · SKILL.md (reported line 55)May include surrounding context.
Mode B: MCP Server

Add to your MCP config (Claude Code ~/.claude/mcp.json, Cursor ~/.cursor/mcp.json, etc.):

json
{

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 90% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · README.md (reported line 131)May include surrounding context.
md
### Uninstall - **CLI:** `npm uninstall -g @lessie/cli && rm -rf ~/.lessie/` - **MCP:** Remove the `"lessie"` entry from your `.mcp.json` and `rm -rf ~/.lessie/` ## Quick start

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 90% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · README.md (reported line 132)May include surrounding context.
md
### Uninstall - **CLI:** `npm uninstall -g @lessie/cli && rm -rf ~/.lessie/` - **MCP:** Remove the `"lessie"` entry from your `.mcp.json` and `rm -rf ~/.lessie/` ## Quick start

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 90% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · README.md (reported line 133)May include surrounding context.
md
### Uninstall - **CLI:** `npm uninstall -g @lessie/cli && rm -rf ~/.lessie/` - **MCP:** Remove the `"lessie"` entry from your `.mcp.json` and `rm -rf ~/.lessie/` ## Quick start

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 90% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SKILL.md (reported line 73)May include surrounding context.
md
### Uninstall - **CLI:** `npm uninstall -g @lessie/cli && rm -rf ~/.lessie/` - **MCP:** Remove the `"lessie"` entry from your `.mcp.json` and `rm -rf ~/.lessie/` ## Quick start

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 90% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SKILL.md (reported line 74)May include surrounding context.
md
### Uninstall - **CLI:** `npm uninstall -g @lessie/cli && rm -rf ~/.lessie/` - **MCP:** Remove the `"lessie"` entry from your `.mcp.json` and `rm -rf ~/.lessie/` ## Quick start

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · README.md (reported line 132)May include surrounding context.
md
### Uninstall - **CLI:** `npm uninstall -g @lessie/cli && rm -rf ~/.lessie/` - **MCP:** Remove the `"lessie"` entry from your `.mcp.json` and `rm -rf ~/.lessie/` ## Quick start

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SKILL.md (reported line 73)May include surrounding context.
md
### Uninstall - **CLI:** `npm uninstall -g @lessie/cli && rm -rf ~/.lessie/` - **MCP:** Remove the `"lessie"` entry from your `.mcp.json` and `rm -rf ~/.lessie/` ## Quick start

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SKILL.md (reported line 74)May include surrounding context.
md
### Uninstall - **CLI:** `npm uninstall -g @lessie/cli && rm -rf ~/.lessie/` - **MCP:** Remove the `"lessie"` entry from your `.mcp.json` and `rm -rf ~/.lessie/` ## Quick start

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 90% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SKILL.md (reported line 73)May include surrounding context.
md
### Uninstall - **CLI:** `npm uninstall -g @lessie/cli && rm -rf ~/.lessie/` - **MCP:** Remove the `"lessie"` entry from your `.mcp.json` and `rm -rf ~/.lessie/` ## Quick start

Chaining Abuse

High

Category: Tool Misuse
Confidence: 75% confidence
Finding: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
Content: Scanner excerpt · README.md (reported line 131)May include surrounding context.
md
### Uninstall - **CLI:** `npm uninstall -g @lessie/cli && rm -rf ~/.lessie/` - **MCP:** Remove the `"lessie"` entry from your `.mcp.json` and `rm -rf ~/.lessie/` ## Quick start

Chaining Abuse

High

Category: Tool Misuse
Confidence: 75% confidence
Finding: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
Content: Scanner excerpt · SKILL.md (reported line 73)May include surrounding context.
md
### Uninstall - **CLI:** `npm uninstall -g @lessie/cli && rm -rf ~/.lessie/` - **MCP:** Remove the `"lessie"` entry from your `.mcp.json` and `rm -rf ~/.lessie/` ## Quick start

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The README prominently markets contact enrichment and 'Get Sam Altman's contact info' before any meaningful privacy or lawful-use warning. In a skill specifically designed to find people and retrieve email/phone data, this encourages collection and use of sensitive personal data without clear guardrails, increasing risk of privacy abuse, spam, or unlawful processing.
Content: No source excerpt is available for this finding.

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 85% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · README.md (reported line 195)May include surrounding context.
Use /lessie for all people search, contact enrichment, company research, and sourcing tasks.

text
**Codex can't find the skill?** Check that `SKILL.md` exists at `.agents/skills/lessie/SKILL.md` or `~/.codex/skills/lessie/SKILL.md` ## Links

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 80% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · README.md (reported line 195)May include surrounding context.
Use /lessie for all people search, contact enrichment, company research, and sourcing tasks.

text
**Codex can't find the skill?** Check that `SKILL.md` exists at `.agents/skills/lessie/SKILL.md` or `~/.codex/skills/lessie/SKILL.md` ## Links

Rp1

Medium

Category: MCP Rug Pull
Confidence: 91% confidence
Finding: The skill instructs the agent to execute npx @lessie/cli without a pinned version, which permits fetching whatever package version is current at execution time. In an agent context, this creates supply-chain risk: a compromised publisher account, malicious update, or typosquat could cause arbitrary code execution on the host.
Content: No source excerpt is available for this finding.

Unrestricted Tool Access

Medium

Category: Excessive Agency
Confidence: 92% confidence
Finding: The reference explicitly documents a generic tools + call fallback that can invoke any remotely exposed tool with raw JSON arguments, bypassing the guardrails and parameter constraints of curated shortcut commands. In a skill that searches, enriches, and performs web research on people and companies, this expands the callable surface to whatever the remote server exposes at runtime, increasing the risk of unauthorized data access, unsafe side effects, or invocation of newly added tools that were never reviewed in the skill context.
Content: Scanner excerpt · references/cli-reference.md (reported line 59)May include surrounding context.
bash
lessie tools # List all available remote tools with full parameter schemas lessie call <tool_name> --args '{"key":"val"}' # Call any tool by name with raw JSON arguments

lessie tools fetches the latest tool list directly from the remote server. Each tool entry includes:

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The guidance provides a confirmation example only in Chinese: "你是指做 AI Agent 的 Manus AI (manus.im) 吗？" This can be read as steering the agent toward a specific language without user opt-in, which conflicts with language/locale neutrality expectations.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T08 · Insecure Dependencies

Vulnerability Details

Vulnerable Code

Technical Analysis

Remediation Suggestions

T09 · Insecure Skill Coding Practices

Vulnerability Details

Vulnerable Code

Remediation Suggestions

SkillSpector

MCP Config Access

Agent Config Directory Access

Tool Parameter Abuse

Tool Parameter Abuse

Tool Parameter Abuse

Agent Config Directory Access

Vague Triggers

MCP Config Access

Mode B: MCP Server

Tool Parameter Abuse

Tool Parameter Abuse

Tool Parameter Abuse

Tool Parameter Abuse

Tool Parameter Abuse

Tool Parameter Abuse

Tool Parameter Abuse

Tool Parameter Abuse

Tool Parameter Abuse

Chaining Abuse

Chaining Abuse

Missing User Warnings

Skill Enumeration

Skill Enumeration

Rp1

Unrestricted Tool Access

Natural-Language Policy Violations

Static analysis