Agent Registry

• Outcome: Review
• Latest audit: Sep 10, 2026 · 5:10 AM UTC
• Version: 2.0.1

Overview

The skill is mostly purpose-aligned, but it installs an automatic prompt hook that can inject untrusted agent metadata into context and uses broad mandatory instructions around loading agent content.

Install only if you are comfortable with a persistent hook that locally checks most prompts against your agent registry and may add agent suggestions to context. Review migrated agent files as trusted content, keep telemetry unset or set AGENT_REGISTRY_NO_TELEMETRY/DO_NOT_TRACK, avoid --move unless backed up, and prefer pinned install/update commands over floating npx usage.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:5
• Finding: Mandatory Skill Instructions Override the Agent's Normal Workflow<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:5-9`, `SKILL.md:25`, `SKILL.md:37-48` **Vulnerability Type**: T01: Skill Instruction Hijacking **Risk Level**: High ### Vulnerable Code ```yaml description: | MANDATORY agent discovery system for token-efficient agent loading. Claude MUST use this skill instead of loading agents directly from ~/.claude/agents/ or .claude/agents/. Provides lazy loading via search and get tools. Use when: (1) user task may benefit from specialized agent expertise, (2) user asks about available agents, (3) starting complex workflows that historically used agents. ``` ```markdown ## CRITICAL RULE **NEVER assume agents are pre-loaded.** Always use this registry to discover and load agents. ``` ```markdown ## Search First Pattern 1. **Extract intent keywords** from user request 2. **Run search**: `bun bin/search.js "<keywords>"` 3. **Review results**: Check relevance scores (0.0-1.0) 4. **Load if needed**: `bun bin/get.js <agent-name>` 5. **Execute**: Follow the loaded agent's instructions ``` ### Technical Analysis The Skill uses imperative priority language such as “MANDATORY,” “MUST,” “NEVER,” and “ALWAYS” to redirect the Agent's workflow through the registry. It then tells the Agent to execute instructions loaded dynamically from local agent files. The declared lazy-loading functionality only requires offering search and retrieval capabilities. It does not require asserting unconditional control over the Agent's decision-making or instructing it to follow dynamically loaded content without preserving higher-priority constraints. This creates an instruction-hijacking trust chain: the Skill text mandates registry use, and the selected registry entry can introduce additional instructions whose trustworthiness is not established. ### Attack Path 1. The Skill is installed and loaded into an Agent session. 2. Its mandatory language directs the Agent to use the registry for relevant tasks. 3. An attacke ...[truncated 774 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace mandatory language with optional, task-scoped guidance. 2. Remove phrases such as “Claude MUST,” “NEVER,” and “ALWAYS do this first.” 3. State explicitly that loaded agent files are untrusted content and cannot override system, developer, user, organizational, or safety instructions. 4. Require explicit user approval before loading or applying a newly discovered agent. 5. Define a trust policy for registered agents, including source validation and review status. 6. Change the final workflow step to: “Use relevant, safe portions of the loaded content only after validating them against higher-priority instructions.” ]]>

T01 · Skill Instruction Hijacking

Error

• Location: hooks/user_prompt_search.js:46
• Finding: Untrusted Agent Metadata Is Automatically Injected into Model Context<![CDATA[ ## Vulnerability Details **File Location**: `lib/parse.js:34-64`, `bin/init.js:319-329`, `hooks/user_prompt_search.js:46-77` **Vulnerability Type**: T01: Skill Instruction Hijacking **Risk Level**: High ### Vulnerable Code The parser copies the first suitable lines from an agent file without validating whether they contain instruction-like content: ```javascript const summaryLines = []; for (let i = startIdx; i < lines.length; i++) { const stripped = lines[i].trim(); if (!stripped) { if (summaryLines.length > 0) break; continue; } if (stripped.startsWith("#")) continue; summaryLines.push(stripped); if (summaryLines.join(" ").length > 150) break; } let summary = summaryLines.join(" "); if (summary.length > 200) { summary = summary.slice(0, 197) + "..."; } ``` The derived summary is persisted in the registry: ```javascript registry.agents.push({ name: agent.name, path: relPath, summary: agent.summary, keywords: agent.keywords, token_estimate: agent.token_estimate, content_hash: agent.content_hash, }); ``` The hook then inserts the untrusted name and summary into `additionalContext` on qualifying user prompts: ```javascript const results = searchAgents(prompt, registry, TOP_K).filter( (r) => r.score >= SCORE_THRESHOLD ); if (results.length === 0) { process.exit(0); } const lines = ["Agent Registry found relevant agents for this task:", ""]; for (const r of results) { lines.push(` - ${r.name} (score: ${r.score.toFixed(2)}): ${r.summary}`); } lines.push(""); lines.push("To load an agent: bun bin/get.js <agent-name>"); console.log(JSON.stringify({ additionalContext: lines.join("\n") })); ``` ### Technical Analysis Agent Markdown files are input from user-level or project-level agent directories. Their names and textual summaries must therefore be treated as untrusted data. `extractSummary()` preserves arbitrary Markdown text other than headings and truncates it only by length. Neither registry generation ...[truncated 1638 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Do not insert free-form agent summaries into `additionalContext`. 2. Emit only strictly validated identifiers, numeric scores, and fixed application-generated text. 3. Validate names and metadata against restrictive length and character allowlists. 4. Store summaries as display-only data and clearly delimit them as untrusted. 5. Add a fixed instruction stating that registry metadata is informational data and must never be followed as instructions. 6. Require explicit user confirmation before loading an agent or adding any of its content to model context. 7. Maintain a trust or approval flag for each agent and exclude unreviewed entries from automatic discovery. 8. Add tests containing common prompt-injection phrases to ensure they are rejected, escaped, or never inserted into model context. ]]>

T08 · Insecure Dependencies

Warning

• Location: install.sh:68
• Finding: Installation Uses Unpinned Executable Packages and Ignores the Lockfile<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:76-83`, `package.json:24-26`, `install.sh:68-80`, `install.sh:87-94` **Vulnerability Type**: T08: Insecure Dependencies **Risk Level**: Medium ### Vulnerable Code The documented installation executes an unpinned CLI package: ```bash # Using Skills CLI (recommended) npx skills add MaTriXy/Agent-Registry@agent-registry # Discover skills interactively npx skills find # Update existing skills npx skills update ``` The dependency uses a floating compatible-version range: ```json "dependencies": { "@clack/prompts": "^1.0.0" } ``` The installer copies `package.json` but does not copy the repository's `package-lock.json`: ```bash cp "$SCRIPT_DIR/SKILL.md" "$INSTALL_DIR/" cp "$SCRIPT_DIR/package.json" "$INSTALL_DIR/" cp "$SCRIPT_DIR/lib/"*.js "$INSTALL_DIR/lib/" cp "$SCRIPT_DIR/bin/"*.js "$INSTALL_DIR/bin/" chmod +x "$INSTALL_DIR/bin/"*.js cp "$SCRIPT_DIR/hooks/"*.js "$INSTALL_DIR/hooks/" chmod +x "$INSTALL_DIR/hooks/"*.js ``` It subsequently performs dependency resolution and installation: ```bash if [ "$INSTALL_DEPS" -eq 1 ]; then echo -e "\n${CYAN}Installing optional dependencies...${NC}" if (cd "$INSTALL_DIR" && npm install --production >/dev/null 2>&1); then echo -e "${GREEN}✓ Optional dependencies installed via npm${NC}" elif (cd "$INSTALL_DIR" && bun install >/dev/null 2>&1); then echo -e "${GREEN}✓ Optional dependencies installed via bun${NC}" else echo -e "${YELLOW}! Could not install optional dependencies automatically${NC}" echo -e "${YELLOW}! Fallback text mode still works for init${NC}" fi fi ``` ### Technical Analysis `npx skills` resolves and executes a package without an explicit version. Separately, `@clack/prompts` is specified using a caret range. Although the repository contains a lockfile, the traditional installer does not copy it to the destination before running `npm install` or `bun install`. This makes installation ...[truncated 1313 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin the Skills CLI to an exact reviewed version in all `npx` commands. 2. Pin `@clack/prompts` to an exact version rather than using a caret range. 3. Copy `package-lock.json` into the installation directory. 4. Use `npm ci --omit=dev` instead of `npm install --production` to enforce the lockfile. 5. Use `--ignore-scripts` where dependency lifecycle scripts are unnecessary. 6. Verify package integrity hashes before installation. 7. Prefer the built-in dependency-free fallback unless the user explicitly requests the enhanced interface. 8. Document the network access and code-execution implications of installing optional packages. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (31)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: Undisclosed telemetry, fetch-based network behavior, and environment-variable-based runtime logic would materially exceed the stated purpose of an agent discovery skill. Even if telemetry is opt-in, omission from the top-level description weakens informed review and can hide data-flow and policy implications.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: Undisclosed telemetry, fetch-based network behavior, and environment-variable-based runtime logic would materially exceed the stated purpose of an agent discovery skill. Even if telemetry is opt-in, omission from the top-level description weakens informed review and can hide data-flow and policy implications.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence
• Finding: Undisclosed telemetry, fetch-based network behavior, and environment-variable-based runtime logic would materially exceed the stated purpose of an agent discovery skill. Even if telemetry is opt-in, omission from the top-level description weakens informed review and can hide data-flow and policy implications.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: Undisclosed telemetry, fetch-based network behavior, and environment-variable-based runtime logic would materially exceed the stated purpose of an agent discovery skill. Even if telemetry is opt-in, omission from the top-level description weakens informed review and can hide data-flow and policy implications.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: Undisclosed telemetry, fetch-based network behavior, and environment-variable-based runtime logic would materially exceed the stated purpose of an agent discovery skill. Even if telemetry is opt-in, omission from the top-level description weakens informed review and can hide data-flow and policy implications.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: Undisclosed telemetry, fetch-based network behavior, and environment-variable-based runtime logic would materially exceed the stated purpose of an agent discovery skill. Even if telemetry is opt-in, omission from the top-level description weakens informed review and can hide data-flow and policy implications.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: Undisclosed telemetry, fetch-based network behavior, and environment-variable-based runtime logic would materially exceed the stated purpose of an agent discovery skill. Even if telemetry is opt-in, omission from the top-level description weakens informed review and can hide data-flow and policy implications.

Ae1

High

• Category: analysis-evasion

Content

| `list.js` | User asks "what agents do I have" or needs overview | `bun bin/list.js` |

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

bun bin/init.js

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

bun bin/init.js

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Intent-Code Divergence

High

• Confidence: 99% confidence
• Finding: The comments claim that no search queries or personal information are collected, but the track function merges arbitrary caller-supplied keys and values directly into the transmitted query string. This means any caller can accidentally or deliberately send prompts, search terms, repository names, file paths, or other sensitive context, making the privacy claim misleading and increasing the chance of silent data exfiltration.

Credential Access

High

• Category: Privilege Escalation

Content

});

    test("rejects path traversal entries", () => {
      const result = resolveRegistryAgentPath("../../etc/passwd");
      expect(result.ok).toBe(false);
      expect(result.error).toContain("Refusing to load agent outside");
    });

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Session Persistence

Medium

• Category: Rogue Agent

Content

- **`references/registry.json`** — Lightweight index storing agent metadata (name, summary, keywords, token_estimate, content_hash). This is the only file loaded into context at conversation start.
- **`agents/`** — Migrated agent markdown files, organized by subdirectory categories. Entirely git-ignored (user-specific data).
- **`lib/`** — Shared JavaScript modules (run on Bun):
  - `registry.js` — Path utilities and registry I/O (read/write registry.json, resolve skill paths).
  - `parse.js` — Agent file parsing (extract frontmatter, summary, keywords, token estimates).
  - `search.js` — BM25 + keyword matching search engine. Custom BM25 implementation (no external dependencies).
  - `telemetry.js` — Fire-and-forget anonymous telemetry using fetch. Disabled by default; opt-in via `AGENT_REGISTRY_TELEMETRY=1`. Also respects `AGENT_REGISTRY_NO_TELEMETRY=1` and `DO_NOT_TRACK=1`.

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The skill advertises a `UserPromptSubmit` hook that analyzes every user prompt automatically and injects matching agents into context. Because this activation is broad and prompt-driven, it can cause unintended invocation, increase exposure to prompt-manipulation effects, and silently alter model behavior on unrelated tasks.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The README documents a `--move` option as a destructive migration path without an explicit warning about irreversible file relocation or potential data loss. In a skill that operates on users' agent files under home directories, this can lead to accidental destruction, broken workflows, or loss of untracked custom agents if users follow the command casually.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The README describes optional telemetry collection for a skill whose core purpose is local agent discovery and lazy loading, expanding the trust boundary beyond what users may expect from a local indexing tool. Even if disabled by default, adding network-capable telemetry increases privacy and supply-chain exposure, especially in a tool that processes user prompts and agent metadata.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill declares executable hook behavior and references shell, environment, and likely network-capable scripts, but it does not declare an explicit tool scope or permissions boundary. That makes the skill's effective capabilities opaque to users and reviewers, increasing the chance of unintended command execution or data access through the hook path.

Natural-Language Policy Violations

Medium

• Confidence: 89% confidence
• Finding: The skill repeatedly states that Claude 'MUST' use this registry and 'NEVER' assume agents are pre-loaded, imposing mandatory behavior without user opt-in or context limitation. Forced routing through a hook-driven registry centralizes trust in this skill and can override safer or more transparent workflows, especially if the registry or hook is compromised.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The activation guidance is broad: it says to use the skill whenever a task may benefit from specialized agents, when the user asks about agents, or when starting complex workflows. Combined with the automatic prompt hook, these vague conditions can cause unnecessary interception and execution on many prompts, increasing exposure of user content and expanding the blast radius of any bug or malicious update.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 88% confidence
• Finding: Using `npx skills add MaTriXy/Agent-Registry@agent-registry` without pinning an immutable version or digest allows installation of whatever package state resolves at execution time. This creates supply-chain risk because a later malicious or compromised release could be pulled implicitly by users following the instructions.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 86% confidence
• Finding: The `npx skills find` instruction executes a remote package/tool path without a pinned version, so behavior may change over time or be compromised upstream. Even discovery commands can expose users to unreviewed code execution in their local environment.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 88% confidence
• Finding: The `npx skills update` instruction is especially risky because it encourages fetching and executing the latest remote code without version constraints. In a skill that already manages local agent files and hooks, an upstream compromise could directly affect local workflow behavior.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.env_credential_access

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: tests/cli.test.js:13

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: lib/telemetry.js:34