agt0

• Outcome: Pass
• Latest audit: Sep 14, 2026 · 10:17 PM UTC
• Version: 1.0.1

Overview

The skill is a coherent guide for a local storage CLI; it is not deceptive, but users should treat its global npm install and deletion examples carefully.

Install only if you are comfortable adding a global npm CLI, preferably pin or verify the package version, avoid running the install with elevated privileges, and require explicit confirmation before using delete, rm, or --yes commands because they can remove stored data.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:15

Finding

Unpinned Global npm Package Installation Creates a Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 15–18
Vulnerability Type: Unpinned third-party dependency installed globally
Risk Level: Medium

Vulnerable Code

bash

npm install -g @seekcontext/agt0
agt0 init <dbname>
agt0 use <dbname>          # set as default (omit db name in later commands)

Technical Analysis

The setup instructions install @seekcontext/agt0 from the npm registry without specifying an exact version or validating package integrity. Consequently, the code installed and executed can change independently of the reviewed skill document.

The -g option installs the package globally and exposes its command-line entry points to the user's environment. If a future release is compromised, the package ownership is taken over, or the npm account or publishing pipeline is breached, following these instructions could execute attacker-controlled npm lifecycle scripts during installation. Subsequent agt0 commands would also execute the compromised package.

This is a supply-chain weakness rather than evidence that the currently published package is malicious.

Attack Path

1. An attacker compromises the package maintainer account, release pipeline, or another component of the package's dependency chain.
2. The attacker publishes a malicious version under the existing @seekcontext/agt0 package name.
3. A user follows the documented setup command without specifying a reviewed version.
4. npm resolves and globally installs the attacker-controlled release.
5. Malicious lifecycle scripts can execute during installation, or malicious logic can execute when the user runs agt0 init, agt0 use, or another installed command.
6. The payload operates with the privileges of the installing user, or with elevated privileges if the installation was run through an administrator or root context.

Impact Assessment

Successful exploitation could allow arbitrary cod ...[truncated 550 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the package to an explicitly reviewed version, for example:

  bash

  npm install -g @seekcontext/agt0@<reviewed-version>
  

• Record and verify the expected npm package integrity digest before installation.

• Review the selected package version, its transitive dependencies, and its lifecycle scripts before recommending it.

• Prefer a project-local installation with a committed lockfile over a global installation where operationally possible.

• Execute the tool through a package manager mode that honors the lockfile, such as npm ci, rather than resolving a mutable dependency version at setup time.

• Disable lifecycle scripts during installation when they are not required:

  bash

  npm install --ignore-scripts @seekcontext/agt0@<reviewed-version>
  

• Avoid running npm installation commands as root or through sudo.

• Establish a controlled update process in which newer versions are reviewed and their integrity is verified before the pinned version is changed.

SkillSpector

Vulnerability Patterns

• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 49)May include surrounding context.

agt0 fs cat myapp:/data/data.csv # read file agt0 fs ls myapp:/data/ # list directory agt0 fs get myapp:/data/data.csv ./local.csv # download file agt0 fs rm myapp:/data/old.csv # delete file agt0 fs mkdir myapp:/data/exports # create directory

text

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The documentation includes agt0 delete <db> --yes, which explicitly bypasses confirmation and can permanently remove an entire local database file. In an agent setting, users or downstream agents may copy/paste this command without appreciating that it is irreversible, increasing the risk of destructive actions and data loss.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This markdown file documents destructive operations such as agt0 fs rm to delete files, but it does not warn that the action is irreversible or may remove user data. Under the markdown-specific missing-warning rule, user-facing skill instructions should disclose behaviors that can affect data integrity.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 155)May include surrounding context.

md

**Options** (JSON string, 2nd arg): `exclude` (comma-separated globs), `strict` (bool — fail on bad rows), `delimiter` (string), `header` (bool). (`exclude` is ignored by `*_expand` modules.)

**Limits** (env vars): `AGT0_FS_MAX_FILES`, `AGT0_FS_MAX_FILE_BYTES`, `AGT0_FS_MAX_TOTAL_BYTES`, `AGT0_FS_MAX_ROWS` (optional cap per TVF / expand scan), `AGT0_FS_PARSE_CHUNK_BYTES`, `AGT0_FS_PREVIEW_BYTES` (multi-file CSV/TSV column discovery), `AGT0_FS_EXPAND_JSONL_SCAN_LINES` (JSONL key discovery for `jsonl_expand`), `AGT0_SQL_FS_EXPAND` (CLI rewrite of literal-path `fs_*` TVFs; default on).

---