Csb Agent Eval

• Outcome: Review
• Latest audit: Jul 19, 2026 · 10:57 AM UTC
• Version: 0.2.0

Overview

This is a coherent agent-evaluation skill, but it sends personal/contextual test prompts to configured local and public agents and saves response artifacts without enough privacy scoping or retention guidance.

Review before installing or running. Use it only against agents you are authorized to test, check config/agents.json for public endpoints, avoid production or sensitive agents unless the operator consents, and treat eval-results/ as potentially sensitive because it can contain prompts and agent response excerpts. Do not enable any external Feishu/cron delivery unless you have reviewed exactly what will be sent and where.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (9)

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The README explicitly states that scheduled evaluation results are pushed to Feishu, but provides no warning, consent model, scoping, or data-handling guidance. If evaluation outputs include prompts, model responses, identifiers, or internal benchmark content, this creates a real risk of unintended external data transmission to a third-party service.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The documentation instructs users to run scripts that probe agents, send evaluation prompts, and persist results to disk, but it does not clearly disclose those side effects or the privacy/security implications. In this context, the skill evaluates local and remote agents and stores transcripts/reports, so users may unintentionally transmit sensitive prompts or retain sensitive outputs without informed consent or handling guidance.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The script persists evaluation history to disk and includes per-test agent responses, some of which are prompted to reveal user-specific information such as name, city, medical context, preferences, and relationship data. Storing this without notice, minimization, consent, or retention controls creates a privacy leak and a durable source of sensitive data exposure if the host, repo, backups, or logs are accessed.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The script sends prompts and receives agent responses over the network, but it does not clearly disclose that evaluation content is being transmitted to remote endpoints and later reused in reports. In an evaluation context, those prompts and responses may contain sensitive test content, agent identifiers, or user-supplied evaluator labels, so the lack of explicit notice and consent creates a real privacy and data-handling risk.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The script persists detailed evaluation artifacts, including response previews, multi-turn interaction metadata, and historical results, to local files without an explicit user-facing warning or retention controls. If the evaluated agents echo secrets, internal prompts, or personal data, that information will be written to disk and remain accessible to other local users, backups, or later processes.

Ssd 3

High

• Confidence: 99% confidence
• Finding: The evaluation suite deliberately probes for recall of highly specific personal data and interpersonal context, including name, city, interests, recent activities, relationship roles, and possible medical information, then stores resulting responses in history. This combines privacy elicitation with durable retention, increasing the chance of unauthorized disclosure, model-memory testing against real PII, and downstream leakage through files, backups, or source control.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"start": "node server.js"
  },
  "dependencies": {
    "express": "^4.18.2",
    "node-fetch": "^2.7.0"
  }
}

• Confidence: 93% confidence
• Finding: Using a caret range for express allows installation of future 4.x releases that may change over time, reducing build reproducibility and increasing supply-chain risk if a bad or compromised release is published. In an agent skill context, dependency drift can silently introduce vulnerable code into the deployed service.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

},
  "dependencies": {
    "express": "^4.18.2",
    "node-fetch": "^2.7.0"
  }
}

• Confidence: 92% confidence
• Finding: Using a caret range for node-fetch permits non-deterministic dependency resolution within the major version, which weakens reproducibility and can expose the skill to newly introduced vulnerable or compromised releases. Because this project appears to perform network operations, dependency integrity is especially important.

Known Vulnerable Dependency: express==4.18.2 — 2 advisory(ies): CVE-2024-43796 (express vulnerable to XSS via response.redirect()); CVE-2024-29041 (Express.js Open Redirect in malformed URLs)

Low

• Category: Supply Chain
• Confidence: 90% confidence
• Finding: The declared express version 4.18.2 is associated with published advisories for XSS via response.redirect() and malformed-URL open redirect behavior. While package.json alone does not prove the vulnerable APIs are used, carrying a dependency with known security issues increases risk for any HTTP service built on it.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

• Code: suspicious.install_untrusted_source
• Location: config/agents.json:3