T08 · Insecure Dependencies
Warning
- Location
SKILL.md:13- Finding
Unpinned Global npm Package Installation Creates Supply-Chain Risk
- Content
View full analysis
- Remediation
View remediation
Security audit
run402
Security checks for vulnerabilities and agentic risk
Overview
The skill is mostly a coherent Run402 deployment guide, but it grants broad paid cloud-management authority with under-scoped invocation, persistent wallet/project credentials, destructive operations, and optional feedback transmission to developers.
Review this skill before installing. Use it only for explicit Run402 tasks, prefer a pinned or locally installed CLI, keep the wallet and service keys isolated, and require explicit confirmation before paid actions, deletion, publishing, checkout creation, or sending feedback to Run402 developers.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
other
Note
- Location
SKILL.md:581- Finding
Unnecessary Paid Transmission of User Feedback to an External Telegram Channel
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Rogue AgentSelf-Modification, Session Persistence
Findings (19)
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 92% confidence
- Finding
The skill exposes a direct delete operation against REST resources using administrative credentials, but does not state that deletion requires explicit user confirmation or parameter validation. In an agent setting, this makes destructive actions vulnerable to ambiguous prompts, prompt injection, or accidental target selection.
- Content
-d '{"done": true}'
Delete
DELETE /rest/v1/todos?id=eq.1 -H "apikey: $SERVICE_KEY"
text
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 89% confidence
- Finding
The storage API includes object deletion with no documented confirmation or path-safety checks. Without guardrails, an agent could delete the wrong object or be tricked into removing user files via crafted prompts or manipulated object paths.
- Content
md -H "apikey: $ANON_KEY" # Delete DELETE /storage/v1/object/assets/photo.jpg -H "apikey: $ANON_KEY" # Signed URL (1h expiry)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
}
text Functions access secrets via `process.env.SECRET_NAME`. Deployed to Lambda. Accessible at `https://api.run402.com/functions/v1/<name>`. Limits per tier: prototype=5, hobby=25, team=100.
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 88% confidence
- Finding
Releasing a subdomain is a public-facing destructive change that can break application access, yet the skill does not require an explicit confirmation or ownership/context verification step. This creates risk of accidental or malicious deconfiguration.
- Content
-H "Authorization: Bearer $SERVICE_KEY"
Release
DELETE /v1/subdomains/myapp -H "Authorization: Bearer $SERVICE_KEY"
text
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 86% confidence
- Finding
The auth quick reference advertises destructive DELETE capability for subdomains as a routine authorized action without surrounding safety constraints. Summarizing a powerful operation this way makes it easier for an agent or integrator to treat it as a normal low-friction tool call.
- Content
md | Auth Method | Header | Used For | |-------------|--------|----------| | x402 payment | (automatic via x402 client) | `POST /v1/projects`, `/v1/deployments`, `/v1/generate-image`, `/v1/message`, `/v1/projects/:id/renew`, `/v1/deploy/:tier` | | service_key | `Authorization: Bearer {service_key}` | `/admin/v1/projects/:id/*`, `POST /v1/subdomains`, `DELETE /v1/subdomains/:name` | | apikey | `apikey: {anon_key or service_key or access_token}` | `/rest/v1/*`, `/auth/v1/*`, `/storage/v1/*` | ---
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 76% confidence
- Finding
The skill provisions a local wallet that persists at a fixed path, and the invocation guidance is broad enough that the skill could be used more often than necessary. Persistent local credentials/state increase the chance of unintended reuse across tasks, cross-context actions, or accidental spending if the skill is invoked loosely.
- Content
md --- name: run402 description: Provision Postgres databases, deploy static sites, generate images, and build full-stack webapps on Run402 using x402 micropayments. Use when the user asks to build a webapp, deploy a site, create a database, generate images, or mentions Run402. version: 3.0.0 ---
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The manifest description materially understates the skill's capabilities by omitting user auth, storage, billing, app publishing/forking, and outbound developer messaging. This can cause an orchestrator or reviewer to grant or invoke the skill under a narrower trust model than the skill actually requires, increasing the chance of unexpected data handling or sensitive actions.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The invocation text is overly broad, including triggers like 'build a webapp' or merely 'mentions Run402,' which can cause the skill to activate in contexts not requiring its powerful provisioning, billing, storage, and admin features. Overbroad triggering increases the attack surface for prompt-driven misuse and accidental execution of sensitive operations.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md Response includes: `project_id`, `anon_key`, `service_key`, `site_url`, `deployment_id`, `functions[].url`, `subdomain_url`. Functions accessible at: `https://api.run402.com/functions/v1/<name>` ---
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md Response includes: `project_id`, `anon_key`, `service_key`, `site_url`, `deployment_id`, `functions[].url`, `subdomain_url`. Functions accessible at: `https://api.run402.com/functions/v1/<name>` ---
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md Response includes: `project_id`, `anon_key`, `service_key`, `site_url`, `deployment_id`, `functions[].url`, `subdomain_url`. Functions accessible at: `https://api.run402.com/functions/v1/<name>` ---
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md Response includes: `project_id`, `anon_key`, `service_key`, `site_url`, `deployment_id`, `functions[].url`, `subdomain_url`. Functions accessible at: `https://api.run402.com/functions/v1/<name>` ---
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md Response includes: `project_id`, `anon_key`, `service_key`, `site_url`, `deployment_id`, `functions[].url`, `subdomain_url`. Functions accessible at: `https://api.run402.com/functions/v1/<name>` ---
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md Response includes: `project_id`, `anon_key`, `service_key`, `site_url`, `deployment_id`, `functions[].url`, `subdomain_url`. Functions accessible at: `https://api.run402.com/functions/v1/<name>` ---
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md Response includes: `project_id`, `anon_key`, `service_key`, `site_url`, `deployment_id`, `functions[].url`, `subdomain_url`. Functions accessible at: `https://api.run402.com/functions/v1/<name>` ---
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
2. Create Tables (SQL)
bash curl -X POST https://api.run402.com/admin/v1/projects/$PROJECT_ID/sql \ -H "Authorization: Bearer $SERVICE_KEY" \ -H "Content-Type: text/plain" \ -d "CREATE TABLE todos (id serial PRIMARY KEY, task text NOT NULL, done boolean DEFAULT false, user_id uuid);"
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill documents destructive project deletion as a routine management action without an explicit warning or confirmation requirement. In an agent setting, this omission can lead to irreversible deletion or archival actions being performed from ambiguous user prompts or malicious prompt injection.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
Billing and Stripe checkout creation expand the skill from infrastructure deployment into payment facilitation for a human payer. That broader capability can trigger financial workflows and expose wallet/payment identifiers in situations where the manifest suggests only build/deploy behavior.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill includes an outbound messaging feature that sends content to Run402 developers via Telegram, which is outside the core stated purpose of provisioning and deployment. Any agent using this skill could be induced to transmit user content, project details, or internal feedback to an external party without a strong need-to-know boundary.
- Content
Static analysis
No suspicious patterns detected.