Agent OS Asset

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 11:18 AM UTC
• Version: 0.2.0

Overview

This is a disclosed local-first file assetization suite with powerful but gated file, indexing, sync, and optional provider features.

Install from a pinned or directly reviewed source when possible, start with plan-only or dry-run stages, review generated decisions before any `--execute-*` flag, enable LaunchAgent sync only for directories you want watched long term, and use remote summary or embedding settings only with a provider you are willing to send bounded query/index text to.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: README.md:20

Finding

Unpinned Third-Party Installer Execution Through npx

Content

View full analysis

Vulnerability Details

File Location: README.md:20
Vulnerability Type: Supply-chain risk from an unpinned executable dependency
Risk Level: Medium

Vulnerable Code

bash

npx skills add lee-agi/agent-os-asset -g -y

Technical Analysis

The documented installation command invokes the third-party skills package through npx without specifying an exact reviewed version or integrity value. When the package is unavailable locally, npx may retrieve and execute its currently published version. The -y option suppresses the normal confirmation prompt.

Consequently, the code executed during installation is not limited to the version reviewed as part of this audit. A compromised registry account, package takeover, or malicious future package release could change the effective installer payload after this project has been reviewed.

This finding concerns the documented installation path rather than malicious code found in the repository itself.

Attack Path

1. An attacker compromises the registry package, publisher account, or another component involved in resolving the unpinned skills package.
2. The attacker publishes a malicious package version containing hostile CLI or lifecycle code.
3. A user follows the installation command in README.md.
4. npx resolves and downloads the attacker-controlled current version.
5. Because no exact version or integrity constraint is present, and confirmation is suppressed by -y, the downloaded code executes with the privileges of the invoking user.

Impact Assessment

Successful exploitation could provide arbitrary code execution with the invoking user's privileges during installation. Depending on that user's permissions, malicious installer code could read accessible files and credentials, alter user-owned data, install persistence, or modify development tooling and configuration.

No evidence was found that the audited repository itself perfo ...[truncated 119 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the installer package to an exact, reviewed version, for example:

   bash

   npx skills@<audited-exact-version> add lee-agi/agent-os-asset -g
   

2. Remove -y so users can inspect and approve unexpected package retrieval.

3. Document the expected publisher, package version, and package-manager registry.

4. Publish and verify integrity hashes or signed release artifacts before execution.

5. Offer a non-executing installation alternative based on a versioned, checksummed archive.

6. In CI or managed environments, use a lockfile, trusted internal mirror, or preapproved installer binary rather than resolving the latest package dynamically.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (164)

Tainted flow: 'req' from os.environ.get (line 60, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · skills/second-brain/scripts/embedding_rerank.py (reported line 66)May include surrounding context.

python

headers={"Content-Type": "application/json", "Authorization": f"Bearer {key}"},
        method="POST",
    )
    with request.urlopen(req, timeout=30) as response:  # nosec B310: endpoint is explicit configured provider.
        body = json.loads(response.read().decode("utf-8"))
    data = body.get("data", []) if isinstance(body, dict) else []
    vectors = [item.get("embedding") for item in data if isinstance(item, dict)]

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 80% confidence

Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · README.md (reported line 27)May include surrounding context.

md

## Safety Defaults / 默认安全策略

Version 0.2.0 hardens the public suite's execution and trust boundaries while preserving its three bundled child Skills. These controls are regression-tested safeguards, not a promise that external scanners will report no warnings. / 版本 0.2.0 加固公开套件的执行与信任边界，并保留三个随包子技能；这些是经过回归测试的防护，不承诺外部扫描器不再报告警告。

- Discovery and planning are read-only by default / Discovery 与 planning 默认只读。
- Extraction, archive, review apply, deletion, synchronization, remote model use, and indexing require explicit enablement / Extraction、archive、review apply、deletion、synchronization、remote model use 与 indexing 都需要显式启用。

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

The skill includes destructive filesystem mutation, trash/restore operations, and direct operational file management flows that can affect many files under a workspace. That is substantially riskier than the high-level positioning suggests and could enable large-scale unintended data movement or deletion if invoked under overly broad permissions.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The skill includes destructive filesystem mutation, trash/restore operations, and direct operational file management flows that can affect many files under a workspace. That is substantially riskier than the high-level positioning suggests and could enable large-scale unintended data movement or deletion if invoked under overly broad permissions.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The skill includes destructive filesystem mutation, trash/restore operations, and direct operational file management flows that can affect many files under a workspace. That is substantially riskier than the high-level positioning suggests and could enable large-scale unintended data movement or deletion if invoked under overly broad permissions.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The skill includes destructive filesystem mutation, trash/restore operations, and direct operational file management flows that can affect many files under a workspace. That is substantially riskier than the high-level positioning suggests and could enable large-scale unintended data movement or deletion if invoked under overly broad permissions.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The skill includes destructive filesystem mutation, trash/restore operations, and direct operational file management flows that can affect many files under a workspace. That is substantially riskier than the high-level positioning suggests and could enable large-scale unintended data movement or deletion if invoked under overly broad permissions.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The skill includes destructive filesystem mutation, trash/restore operations, and direct operational file management flows that can affect many files under a workspace. That is substantially riskier than the high-level positioning suggests and could enable large-scale unintended data movement or deletion if invoked under overly broad permissions.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The skill includes destructive filesystem mutation, trash/restore operations, and direct operational file management flows that can affect many files under a workspace. That is substantially riskier than the high-level positioning suggests and could enable large-scale unintended data movement or deletion if invoked under overly broad permissions.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The skill includes destructive filesystem mutation, trash/restore operations, and direct operational file management flows that can affect many files under a workspace. That is substantially riskier than the high-level positioning suggests and could enable large-scale unintended data movement or deletion if invoked under overly broad permissions.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill includes destructive filesystem mutation, trash/restore operations, and direct operational file management flows that can affect many files under a workspace. That is substantially riskier than the high-level positioning suggests and could enable large-scale unintended data movement or deletion if invoked under overly broad permissions.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill includes destructive filesystem mutation, trash/restore operations, and direct operational file management flows that can affect many files under a workspace. That is substantially riskier than the high-level positioning suggests and could enable large-scale unintended data movement or deletion if invoked under overly broad permissions.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill includes destructive filesystem mutation, trash/restore operations, and direct operational file management flows that can affect many files under a workspace. That is substantially riskier than the high-level positioning suggests and could enable large-scale unintended data movement or deletion if invoked under overly broad permissions.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill includes destructive filesystem mutation, trash/restore operations, and direct operational file management flows that can affect many files under a workspace. That is substantially riskier than the high-level positioning suggests and could enable large-scale unintended data movement or deletion if invoked under overly broad permissions.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The skill includes destructive filesystem mutation, trash/restore operations, and direct operational file management flows that can affect many files under a workspace. That is substantially riskier than the high-level positioning suggests and could enable large-scale unintended data movement or deletion if invoked under overly broad permissions.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill includes destructive filesystem mutation, trash/restore operations, and direct operational file management flows that can affect many files under a workspace. That is substantially riskier than the high-level positioning suggests and could enable large-scale unintended data movement or deletion if invoked under overly broad permissions.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The skill includes destructive filesystem mutation, trash/restore operations, and direct operational file management flows that can affect many files under a workspace. That is substantially riskier than the high-level positioning suggests and could enable large-scale unintended data movement or deletion if invoked under overly broad permissions.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence

Finding

The skill includes destructive filesystem mutation, trash/restore operations, and direct operational file management flows that can affect many files under a workspace. That is substantially riskier than the high-level positioning suggests and could enable large-scale unintended data movement or deletion if invoked under overly broad permissions.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The skill includes destructive filesystem mutation, trash/restore operations, and direct operational file management flows that can affect many files under a workspace. That is substantially riskier than the high-level positioning suggests and could enable large-scale unintended data movement or deletion if invoked under overly broad permissions.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The skill includes destructive filesystem mutation, trash/restore operations, and direct operational file management flows that can affect many files under a workspace. That is substantially riskier than the high-level positioning suggests and could enable large-scale unintended data movement or deletion if invoked under overly broad permissions.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill includes destructive filesystem mutation, trash/restore operations, and direct operational file management flows that can affect many files under a workspace. That is substantially riskier than the high-level positioning suggests and could enable large-scale unintended data movement or deletion if invoked under overly broad permissions.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill includes destructive filesystem mutation, trash/restore operations, and direct operational file management flows that can affect many files under a workspace. That is substantially riskier than the high-level positioning suggests and could enable large-scale unintended data movement or deletion if invoked under overly broad permissions.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 15)May include surrounding context.

md

w, Hermes, WorkBuddy, and other runtimes that support Agent Skills or can load `SKILL.md` directly. / 将本 Skill 作为供应商中立的套件入口，用于把历史文件设计、审计或重构为 Agent OS 资产；它适用于 Co

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 23)May include surrounding context.

md

w, Hermes, WorkBuddy, and other runtimes that support Agent Skills or can load `SKILL.md` directly. / 将本 Skill 作为供应商中立的套件入口，用于把历史文件设计、审计或重构为 Agent OS 资产；它适用于 Co

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 19)May include surrounding context.

md

- `skills/agent-readable-doc/SKILL.md`: extraction, conversion, validation, and semantic materialization / 提取、转换、校验与语义资产物化。