AXIS TrustLayer AgentFICO

• Outcome: Review
• Latest audit: Sep 12, 2026 · 1:04 AM UTC
• Version: 1.1.0

Overview

The skill’s AXIS API purpose is mostly disclosed, but its executable examples handle session cookies and user input unsafely enough that users should review it before installing or running it.

Install only if you trust AXIS and need these API workflows. Prefer the Python lookup example over the shell lookup script, avoid pasting live session cookies into command lines or chats, and treat registration, event submission, API key creation, and key revocation as account-sensitive actions requiring explicit review.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (6)

T09 · Insecure Skill Coding Practices

Error

• Location: examples/trust-check.sh:15
• Finding: Arbitrary Python Code Execution Through AUID Interpolation<![CDATA[ ## Vulnerability Details **File Location**: `examples/trust-check.sh`, line 15 **Vulnerability Type**: Python source-code injection **Risk Level**: High ### Vulnerable Code ```bash # URL-encode the JSON input INPUT=$(python3 -c "import urllib.parse, json; print(urllib.parse.quote(json.dumps({'json':{'auid':'$AUID'}})))") ``` ### Technical Analysis The script embeds the user-controlled `AUID` argument directly inside Python source passed to `python3 -c`. Shell quoting does not make the resulting Python string safe. An AUID containing Python quote delimiters and additional Python expressions can terminate the intended string and insert new statements. This differs from ordinary malformed input: the value is interpreted as executable Python syntax before it is serialized as JSON or sent to the AXIS API. The injected code runs locally with all permissions of the user invoking the script. ### Attack Path 1. An attacker supplies or publishes a crafted value represented as an AXIS AUID. 2. A victim invokes `trust-check.sh` with that value. 3. The shell expands `$AUID` into the source-code string supplied to `python3 -c`. 4. Crafted quote and statement delimiters escape the intended Python string. 5. Python evaluates the inserted statements locally. 6. The injected code can access files, environment variables, network resources, and commands available to the victim account. ### Impact Assessment Successful exploitation provides arbitrary local code execution with the invoking user's privileges. The resulting scope can include: - Reading files and credentials accessible to the user. - Modifying or deleting user-owned data. - Making arbitrary outbound network requests. - Running local commands or installing user-level persistence. - Compromising authentication material present in the process environment or filesystem. The code does not itself elevate privileges, so exploitation is constrained to the permissions already held by the caller. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions Pass the AUID as data rather than embedding it in Python source: ```bash INPUT=$(python3 -c ' import json import sys import urllib.parse print(urllib.parse.quote(json.dumps({"json": {"auid": sys.argv[1]}}))) ' "$AUID") ``` Additionally: 1. Validate the AUID against the documented format and enforce a reasonable maximum length. 2. Prefer the Python example, which already passes the AUID through normal Python variables. 3. Add regression tests containing quotes, backslashes, newlines, semicolons, and Unicode characters. 4. Never interpolate untrusted data into `python3 -c`, `eval`, shell source, SQL, or another executable language. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: examples/register-agent.sh:19
• Finding: Unsafe JSON Construction in Agent Registration Request<![CDATA[ ## Vulnerability Details **File Location**: `examples/register-agent.sh`, lines 19–22 **Vulnerability Type**: Authenticated API payload injection **Risk Level**: Medium ### Vulnerable Code ```bash RESPONSE=$(curl -sf -X POST "$BASE_URL/agents.register" \ -H "Content-Type: application/json" \ -H "Cookie: $SESSION_COOKIE" \ -d "{\"json\":{\"name\":\"$AGENT_NAME\",\"agentClass\":\"$AGENT_CLASS\"}}") ``` ### Technical Analysis `AGENT_NAME` and `AGENT_CLASS` are concatenated directly into a JSON document without JSON encoding. Shell quoting only controls shell parsing; it does not escape quotation marks, backslashes, control characters, or JSON structural tokens contained in either value. A malicious value can terminate its intended JSON string and inject additional properties. Depending on server-side parsing and schema validation, duplicate properties may replace earlier values, or the request may be interpreted differently from what the user intended. Even benign names containing quotation marks or backslashes can produce invalid JSON and cause denial of operation. ### Attack Path 1. An attacker convinces an authenticated user to register an agent using attacker-controlled name or class text. 2. The victim supplies that text to `register-agent.sh`. 3. The script concatenates the text into the request body without JSON serialization. 4. The crafted value alters the JSON structure or creates duplicate fields. 5. `curl` sends the modified payload using the victim's active AXIS session. 6. If accepted by the API parser and schema, registration occurs with attacker-influenced fields rather than the values shown to the user. ### Impact Assessment The vulnerability can compromise the integrity of authenticated agent-registration requests. Potential effects include: - Registration with unintended field values. - Misclassification or misleading agent metadata. - Failed registrations for otherwise valid names. - Abuse of the victim's authenticated ...[truncated 254 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions Construct the payload with a real JSON serializer and validate enumerated values: ```bash case "$AGENT_CLASS" in enterprise|personal|research|service|autonomous) ;; *) echo "Invalid agent class" >&2; exit 2 ;; esac PAYLOAD=$(python3 -c ' import json import sys print(json.dumps({ "json": { "name": sys.argv[1], "agentClass": sys.argv[2], } })) ' "$AGENT_NAME" "$AGENT_CLASS") RESPONSE=$(curl -sf -X POST "$BASE_URL/agents.register" \ -H "Content-Type: application/json" \ -H "Cookie: $SESSION_COOKIE" \ --data-binary "$PAYLOAD") ``` Also enforce the documented name length, reject control characters where appropriate, and test values containing quotes and backslashes. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: examples/submit-event.sh:26
• Finding: Unsafe JSON and Numeric-Field Construction in Behavioral Event Submission<![CDATA[ ## Vulnerability Details **File Location**: `examples/submit-event.sh`, lines 26–29 **Vulnerability Type**: Authenticated API payload injection and missing input validation **Risk Level**: Medium ### Vulnerable Code ```bash RESPONSE=$(curl -sf -X POST "$BASE_URL/trust.addEvent" \ -H "Content-Type: application/json" \ -H "Cookie: $SESSION_COOKIE" \ -d "{\"json\":{\"agentId\":$AGENT_ID,\"eventType\":\"$EVENT_TYPE\",\"category\":\"submitted_via_skill\",\"scoreImpact\":$SCORE_IMPACT,\"description\":\"$DESCRIPTION\"}}") ``` ### Technical Analysis All request fields are created through string concatenation: - `EVENT_TYPE` and `DESCRIPTION` are inserted into JSON strings without escaping. - `AGENT_ID` and `SCORE_IMPACT` are inserted as raw JSON tokens without verifying that they are integers. - The event-type allowlist and the documented `-100` to `+100` score range are not enforced. An attacker-controlled argument can break out of its intended JSON context, introduce duplicate or additional fields, or change value types. Because the request uses the victim's session cookie, any accepted modification is performed under the victim's authenticated identity. ### Attack Path 1. An attacker provides a crafted event description, event type, agent ID, or score value. 2. An authenticated victim invokes the example script using those values. 3. The script inserts the values directly into the JSON body. 4. The crafted input alters the payload structure, value type, or effective fields. 5. The altered request is submitted to `trust.addEvent` using the victim's session. 6. If the API accepts the payload, an unintended behavioral event is recorded against an agent. ### Impact Assessment Successful exploitation can undermine the integrity of AXIS behavioral-event reporting. Potential effects include: - Events being attributed to an unintended agent. - Submission of an unintended event type or score impact. - Misleading descriptions or categories. - Invalid ...[truncated 381 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Validate numeric fields before constructing the request: ```bash [[ "$AGENT_ID" =~ ^[0-9]+$ ]] || { echo "Agent ID must be a positive integer" >&2 exit 2 } [[ "$SCORE_IMPACT" =~ ^-?[0-9]+$ ]] || { echo "Score impact must be an integer" >&2 exit 2 } (( SCORE_IMPACT >= -100 && SCORE_IMPACT <= 100 )) || { echo "Score impact must be between -100 and 100" >&2 exit 2 } ``` 2. Enforce the documented event-type allowlist with a `case` statement. 3. Generate the complete payload with Python `json.dumps` or `jq -n`. 4. Pass numeric values to the serializer and explicitly convert them to integers. 5. Add tests for quotes, backslashes, newlines, duplicate-field attempts, nonnumeric IDs, and out-of-range scores. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: examples/register-agent.sh:3
• Finding: AXIS Session Cookie Exposed Through Registration Command Arguments<![CDATA[ ## Vulnerability Details **File Location**: `examples/register-agent.sh`, lines 3–11 **Vulnerability Type**: Sensitive authentication material exposed in command-line arguments **Risk Level**: Medium ### Vulnerable Code ```bash # Usage: ./register-agent.sh <session_cookie> <agent_name> <agent_class> # Example: ./register-agent.sh "session=abc123" "My Research Agent" "research" # # Agent classes: enterprise, personal, research, service, autonomous # Requires authentication (session cookie from https://axistrust.io). set -euo pipefail SESSION_COOKIE="${1:?Usage: $0 <session_cookie> <agent_name> <agent_class>}" ``` The cookie is subsequently passed to `curl` as a header: ```bash -H "Cookie: $SESSION_COOKIE" \ ``` ### Technical Analysis The example instructs users to supply an active session cookie as a command-line argument. Command-line arguments can be retained in shell history and may be visible to local process-inspection facilities while the command is running. The cookie is also placed in the `curl` argument vector when the child process is created. A session cookie is a bearer credential: possession may be sufficient to perform operations as the authenticated user until the session expires or is revoked. ### Attack Path 1. A user copies an active AXIS session cookie into the example command. 2. The shell records the command in history, or a local process observes the script or `curl` argument list. 3. The observer extracts the cookie value. 4. The observer replays the cookie in requests to AXIS. 5. The attacker performs operations allowed by the compromised session, subject to server-side expiration and authorization. ### Impact Assessment A stolen session may permit unauthorized authenticated API operations, including agent registration and any other operation available to that AXIS account. The issue does not cross operating-system privilege boundaries by itself; exploitation requires access to command history, process metadata, term ...[truncated 42 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Do not accept session cookies as positional command-line arguments. 2. Prefer a protected cookie file with permissions limited to the user: ```bash COOKIE_FILE="${AXIS_COOKIE_FILE:?Set AXIS_COOKIE_FILE to a protected cookie-jar path}" [[ -f "$COOKIE_FILE" ]] || exit 2 [[ "$(stat -c '%a' "$COOKIE_FILE")" == "600" ]] || { echo "Cookie file must have mode 600" >&2 exit 2 } curl -sf --cookie "$COOKIE_FILE" ... ``` 3. Alternatively, read the secret through a hidden prompt, while ensuring it is not subsequently included literally in a child process's argument vector. 4. Remove real-cookie patterns from usage examples. 5. Recommend short-lived sessions, prompt revocation after exposure, and avoid logging request headers. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: examples/submit-event.sh:3
• Finding: AXIS Session Cookie Exposed Through Event-Submission Command Arguments<![CDATA[ ## Vulnerability Details **File Location**: `examples/submit-event.sh`, lines 3–16 **Vulnerability Type**: Sensitive authentication material exposed in command-line arguments **Risk Level**: Medium ### Vulnerable Code ```bash # Usage: ./submit-event.sh <session_cookie> <agent_id> <event_type> <score_impact> <description> # Example: ./submit-event.sh "session=abc123" 42 "task_completed" 10 "Completed data analysis accurately" # # agent_id: numeric integer (from agents.register or agents.list response) # event_type: task_completed | task_failed | security_pass | security_fail | # compliance_pass | compliance_fail | user_feedback_positive | # user_feedback_negative | peer_feedback_positive | peer_feedback_negative | # incident_reported | incident_resolved | adversarial_detected # score_impact: integer from -100 to +100 # Requires authentication (session cookie from https://axistrust.io). set -euo pipefail SESSION_COOKIE="${1:?Usage: $0 <session_cookie> <agent_id> <event_type> <score_impact> <description>}" ``` The cookie is subsequently included in a `curl` header argument: ```bash -H "Cookie: $SESSION_COOKIE" \ ``` ### Technical Analysis Supplying a bearer session cookie as a positional argument risks disclosure through shell history, process listings, terminal capture, debugging output, or command auditing. The credential also becomes part of the `curl` child process's argument vector. This exposure is unnecessary for the declared event-submission functionality because `curl` can consume a protected cookie file instead. ### Attack Path 1. The user invokes `submit-event.sh` with a live AXIS session cookie. 2. The command is recorded in history or observed through local process inspection. 3. An attacker with access to that data recovers the cookie. 4. The attacker replays the cookie against authenticated AXIS endpoints. 5. Unauthorized behavioral events or other account-authorized actions are submitted befor ...[truncated 394 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions Use a cookie jar or protected credential file rather than a positional argument: ```bash COOKIE_FILE="${AXIS_COOKIE_FILE:?Set AXIS_COOKIE_FILE}" curl -sf --cookie "$COOKIE_FILE" -X POST ... ``` The cookie file should be created with mode `0600`, excluded from version control, and removed when no longer required. Documentation should warn users not to paste live session credentials into commands, logs, chat messages, or issue reports. If a hidden prompt is used, ensure the cookie is not later exposed as a literal child-process argument. ]]>

T08 · Insecure Dependencies

Note

• Location: examples/trust-check.py:8
• Finding: Unpinned Third-Party Python Dependency Installation<![CDATA[ ## Vulnerability Details **File Location**: `examples/trust-check.py`, lines 8–20 **Vulnerability Type**: Mutable dependency installation guidance **Risk Level**: Low ### Vulnerable Code ```python No authentication required. Public endpoint. Requires: requests (pip install requests) """ import sys import json import urllib.parse try: import requests except ImportError: print("Install the requests library: pip install requests") sys.exit(1) ``` ### Technical Analysis The script recommends installing `requests` without a pinned version, lock file, package hash, or approved package-index requirement. The package name is legitimate and widely used, and installation is not automatically performed by the script. Nevertheless, the instruction resolves to mutable package content at installation time. If the package index, account, local package-index configuration, or dependency resolution path is compromised, a user following the instruction could install code that was not reviewed with the Skill. ### Attack Path 1. A user runs the Python example without `requests` installed. 2. The script prints `pip install requests`. 3. The user follows the instruction. 4. `pip` resolves the package and transitive dependencies from its configured index at that time. 5. A compromised index, package release, mirror, or dependency artifact supplies malicious code. 6. That code may execute during installation or when imported by the example. ### Impact Assessment A compromised dependency can execute with the privileges of the user running `pip` or the script. In typical use this means access to the user's virtual environment, files, environment variables, and network permissions. System-wide impact is possible if the user unnecessarily installs packages with elevated privileges, although the project does not instruct users to use `sudo`. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Publish a reviewed dependency specification with an exact version and hashes, for example a hash-locked requirements file. 2. Recommend installation in an isolated virtual environment. 3. Document the expected package index or require an organization-approved index. 4. Regularly review and update the pinned version after security testing. 5. Consider replacing `requests` with Python's standard-library HTTP facilities for this small example, eliminating the external runtime dependency. 6. Do not recommend privileged or system-wide package installation. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (12)

External Script Fetching

High

• Category: Supply Chain

Content

echo "Registering agent: $AGENT_NAME (class: $AGENT_CLASS)"
echo ""

RESPONSE=$(curl -sf -X POST "$BASE_URL/agents.register" \
  -H "Content-Type: application/json" \
  -H "Cookie: $SESSION_COOKIE" \
  -d "{\"json\":{\"name\":\"$AGENT_NAME\",\"agentClass\":\"$AGENT_CLASS\"}}")

• Confidence: 90% confidence
• Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

External Script Fetching

High

• Category: Supply Chain

Content

echo "Submitting event for agent ID $AGENT_ID: $EVENT_TYPE (impact: $SCORE_IMPACT)"
echo ""

RESPONSE=$(curl -sf -X POST "$BASE_URL/trust.addEvent" \
  -H "Content-Type: application/json" \
  -H "Cookie: $SESSION_COOKIE" \
  -d "{\"json\":{\"agentId\":$AGENT_ID,\"eventType\":\"$EVENT_TYPE\",\"category\":\"submitted_via_skill\",\"scoreImpact\":$SCORE_IMPACT,\"description\":\"$DESCRIPTION\"}}")

• Confidence: 90% confidence
• Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

External Script Fetching

High

• Category: Supply Chain

Content

echo "Looking up agent: $AUID"
echo ""

RESPONSE=$(curl -sf "$BASE_URL/agents.getByAuid?input=$INPUT")

# Parse and display key fields
echo "$RESPONSE" | python3 -c "

• Confidence: 90% confidence
• Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill demonstrates network and shell-capable behavior via multiple curl examples but does not declare any tool scope or allowed-tools restrictions. This weakens least-privilege controls and could let an agent invoke broader execution or outbound network actions than users expect when installing or reviewing the skill.

External Transmission

Medium

• Category: Data Exfiltration

Content

```bash
# Look up an agent by AUID — replace AGENT_AUID_HERE with the actual AUID string
# Input must be URL-encoded JSON with a "json" wrapper
curl -s "https://www.axistrust.io/api/trpc/agents.getByAuid?input=%7B%22json%22%3A%7B%22auid%22%3A%22AGENT_AUID_HERE%22%7D%7D"
```

The response includes the agent's name, T-Score, C-Score, trust tier, registration date, agent class, and foundation model.

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The authenticated examples instruct use of session cookies and later API-key operations but do not explicitly warn users not to expose, log, or share those credentials. In agent environments, examples are often copied verbatim, so absent handling guidance can lead to credential leakage through prompts, logs, chat history, or screenshots.

External Transmission

Medium

• Category: Data Exfiltration

Content

```bash
# agentId is a numeric integer
curl -s "https://www.axistrust.io/api/trpc/credit.getScore?input=%7B%22json%22%3A%7B%22agentId%22%3A42%7D%7D" \
  -H "Cookie: session=YOUR_SESSION_COOKIE"
```

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The skill's stated purpose is trust lookup and reputation verification, but it also includes API key listing, creation, and revocation flows. Secret-management operations are more sensitive than read-only trust checks and expand the blast radius if the skill is misused, compromised, or invoked in an unexpected context.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The script requires a live session cookie as a positional argument and then uses it directly for authentication to a remote service. Supplying credentials on the command line is risky because they can be exposed via shell history, process listings, audit logs, or copied usage examples, making credential theft more likely even if the network transport is HTTPS.

External Transmission

Medium

• Category: Data Exfiltration

Content

echo "Registering agent: $AGENT_NAME (class: $AGENT_CLASS)"
echo ""

RESPONSE=$(curl -sf -X POST "$BASE_URL/agents.register" \
  -H "Content-Type: application/json" \
  -H "Cookie: $SESSION_COOKIE" \
  -d "{\"json\":{\"name\":\"$AGENT_NAME\",\"agentClass\":\"$AGENT_CLASS\"}}")

• Confidence: 82% confidence
• Finding: This script transmits an authentication cookie to an external endpoint, which is expected for its function, but it still creates a real credential exposure boundary. If the endpoint, DNS resolution, local environment, or logs are compromised, the session cookie could be reused to impersonate the user and perform authenticated actions.

External Transmission

Medium

• Category: Data Exfiltration

Content

echo "Submitting event for agent ID $AGENT_ID: $EVENT_TYPE (impact: $SCORE_IMPACT)"
echo ""

RESPONSE=$(curl -sf -X POST "$BASE_URL/trust.addEvent" \
  -H "Content-Type: application/json" \
  -H "Cookie: $SESSION_COOKIE" \
  -d "{\"json\":{\"agentId\":$AGENT_ID,\"eventType\":\"$EVENT_TYPE\",\"category\":\"submitted_via_skill\",\"scoreImpact\":$SCORE_IMPACT,\"description\":\"$DESCRIPTION\"}}")

• Confidence: 70% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The script sends the user-supplied AUID to a third-party API endpoint without any explicit consent prompt, privacy warning, or note about data disclosure. Even if the endpoint is intended for public lookups, AUIDs may still identify internal agents, relationships, or operational activity, so transmitting them off-host can leak sensitive metadata.

Static analysis

No suspicious patterns detected.