Agentmfa

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:46 AM UTC
• Version: 1.0.14

Overview

The skill is mostly coherent as a human-approval integration, but it has review-worthy risks around installing an unpinned external CLI and inconsistent handling of approval codes.

Review the CLI source and install provenance before use, avoid installing mutable latest releases in sensitive environments, and do not log or persist approval codes despite the reference file saying to log them.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:12

Finding

Unpinned Third-Party CLI Is Installed and Executed from a Custom Homebrew Tap

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 12-16 and 41-44
Vulnerability Type: Supply-chain exposure through an unpinned executable dependency
Risk Level: Medium

Vulnerable Code

yaml

install:
  - id: brew
    kind: shell
    command: "brew install agentmfa/cli/agentmfa && agentmfa auth login"
    label: "Install AgentMFA CLI and log in"

sh

# 1. Install the CLI
brew install agentmfa/cli/agentmfa

# 2. Log in (opens browser for OAuth)
agentmfa auth login

Technical Analysis

The skill directs the user or agent framework to install the latest available agentmfa package from the custom agentmfa/cli Homebrew tap. It does not pin a reviewed version, verify a cryptographic checksum, or require signature verification.

The metadata command chains installation and execution with &&, causing the newly downloaded binary to run immediately as the current user. The CLI then participates in an OAuth authentication flow and stores its session in the system keychain, according to the skill documentation. Consequently, the integrity of the approval workflow depends on the continuing security of the external tap, package distribution infrastructure, and current release.

This is a supply-chain weakness rather than evidence that the current upstream package is malicious. Exploitation requires compromise of, or unauthorized publishing access to, the package source or distribution channel.

Attack Path

1. An attacker compromises the custom Homebrew tap, its publishing credentials, or a release artifact referenced by the tap.
2. The attacker publishes a modified agentmfa package under the expected package name.
3. A user installs the dependency through the documented unpinned command.
4. Homebrew retrieves and installs the attacker-controlled release.
5. Because installation is chained with agentmfa auth login, the downloaded executable runs immediately with the invoking user's privileges.
6. The malicious bi ...[truncated 745 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the CLI to an explicitly reviewed version rather than installing the latest mutable release.
• Verify release signatures or documented SHA-256 checksums before executing the installed binary.
• Publish and verify reproducible build information where practical.
• Separate installation from authentication so the newly installed binary is not executed automatically in the same shell command.
• Require the user to review the installed version and verification result before initiating OAuth login.
• Document the exact trusted source repository, release identity, signing keys, and expected package provenance.
• Add a controlled upgrade process that reviews and validates new CLI versions before changing the pinned release.

T09 · Insecure Skill Coding Practices

Warning

• Location: references/errors.md:7

Finding

Approval Proof Is Instructed to Be Written to Logs

Content

View full analysis

Vulnerability Details

File Location: references/errors.md, line 7
Vulnerability Type: Sensitive approval-proof disclosure through logging
Risk Level: Medium

Vulnerable Code

markdown

| `approved` | Human approved with biometrics | Proceed; log the `code` as proof |

Technical Analysis

The error-handling reference explicitly instructs the agent to log the approval code. Approval proofs are sensitive authorization artifacts and should not be placed in ordinary application, terminal, CI, telemetry, or centralized logs.

This instruction directly conflicts with the safer rule in SKILL.md, which states that one-time proofs of approval must not be logged or pasted into chat. The contradictory guidance can cause different implementations to handle the same approval response inconsistently. An implementation following references/errors.md could expose the code to users, services, or retention systems that have access to logs but are not authorized to receive approval credentials.

Even if the code is strictly single-use, retaining it unnecessarily discloses sensitive authentication evidence. If server-side one-time-use or expiration enforcement is defective, delayed, or incomplete, the logged value could potentially be replayed.

Attack Path

1. A human approves a sensitive operation and the AgentMFA service returns an approval code.
2. An agent implementation follows references/errors.md and writes the complete code to a terminal, application log, CI log, or centralized logging service.
3. A user, service account, support operator, or attacker with log-reading access obtains the approval code.
4. If the proof remains valid or is not strictly bound to the original request and action, the observer attempts to reuse it to represent an approved action.
5. Even where replay is prevented, the sensitive approval artifact remains unnecessarily disclosed and retained outside the intended authorization channel.

Impact Assessmen

...[truncated 570 chars]

Remediation

View remediation

Remediation Suggestions

• Replace the instruction to log the code with an explicit prohibition against logging, displaying, or persisting approval proofs.
• Log only non-sensitive audit metadata, such as the request identifier, decision, timestamp, action label, and a server-generated non-secret audit event identifier.
• Redact approval codes, tokens, and related proof fields at all logging boundaries.
• Reconcile references/errors.md with the token-handling rule in SKILL.md so all documentation provides one consistent policy.
• Enforce short expiration, strict single use, and cryptographic binding of every approval proof to the specific request, agent identity, and approved action.
• Add automated tests or linting that detect accidental serialization of proof and token fields into logs.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 70% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 69)May include surrounding context.

md

- Any action the agent recognizes as sensitive or irreversible

**Common risky actions requiring approval:**
- `git push --force` or rewriting history
- `kubectl delete` on production resources
- `kubectl apply/edit` to running workloads
- `terraform apply` (especially with deletions shown in plan)

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 70% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 123)May include surrounding context.

md

## Rules

- **The agent decides when to call AgentMFA** — nothing forces automatic approval checks
- **Always wait** for approval before proceeding — never skip or assume approval
- **Abort on rejection** — do not retry the same action without user re-initiation
- **Abort on expiry** — a timed-out request is treated as rejected
- **Be specific** — `action` and `context` should give the human enough detail to decide

Static analysis

No suspicious patterns detected.