Agent Vitamins — Daily Self-Improvement

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:56 AM UTC
• Version: 1.0.0

Overview

The skill has a coherent daily-brief purpose, but its setup and credential handling need review before installation.

Review this before installing. Pin and verify the MCP package version, avoid unattended npx execution where possible, store the Agent Vitamins token only in a proper secret manager, and invoke the skill explicitly rather than letting it run on generic session-start or agent-improvement prompts.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:19

Finding

Unpinned npm Package Is Downloaded and Executed Without Interactive Approval

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 19–28
Vulnerability Type: Supply-chain exposure through an unpinned, automatically executed dependency
Risk Level: High

Vulnerable Code:

json

Add to your MCP config (`.claude/mcp.json` or `~/.claude/mcp.json`):
{
  "mcpServers": {
    "agent-vitamins": {
      "command": "npx",
      "args": ["-y", "mcp-agent-vitamins"]
    }
  }
}

Technical Analysis

The recommended MCP configuration invokes npx with the mutable package name mcp-agent-vitamins and the -y option. No exact version, integrity hash, lockfile, verified repository, or publisher identity is specified.

When invoked, npx can retrieve the currently published package release and execute it under the account running the Agent. The -y option suppresses the normal installation confirmation. Consequently, the code executed at runtime can differ from the dependency version that was available when this Skill was reviewed.

This is a supply-chain weakness rather than evidence that the current package is malicious. However, compromise of the npm publisher account, publication of a malicious later version, or registry/package-name takeover could turn the documented setup command into an arbitrary local code-execution channel.

Attack Path

1. An attacker compromises the npm publisher account, takes control of the package, or causes a malicious package version to be published.
2. The attacker adds malicious installation lifecycle logic or MCP server runtime code to the new release.
3. A user follows the Skill instructions or starts the configured MCP server.
4. npx -y mcp-agent-vitamins resolves and downloads the mutable package release without interactive confirmation.
5. The malicious package executes with the permissions of the user running the Agent.
6. Subject to that user's permissions, the package could read accessible files and environment variables, acc ...[truncated 690 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the MCP package to an exact, reviewed version, for example mcp-agent-vitamins@X.Y.Z, rather than resolving the latest release.
• Provide and verify a package integrity digest or use a lockfile-backed, reproducible installation process.
• Document the authoritative npm publisher and source repository so users can verify package provenance.
• Avoid unattended npx -y execution where practical. Require explicit confirmation before the initial installation or upgrade.
• Review package lifecycle scripts and the MCP server implementation before deployment.
• Run the MCP server in a sandbox or restricted account with only the filesystem and network access necessary to contact the documented brief API.
• Establish an explicit update process in which new versions are reviewed before the pinned version is changed.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:43

Finding

API Token Is Persisted Without a Defined Secure Storage Mechanism

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 43–48
Vulnerability Type: Unsafe credential-storage instruction
Risk Level: Medium

Vulnerable Code:

markdown

## Authentication

The `get_daily_brief` tool needs an API token from agentvitamins.com. If the owner hasn't provided one:
1. Use `get_brief_preview` to show what's available
2. Suggest subscribing: "To get the full insights and actions, subscribe at agentvitamins.com ($7/mo)"
3. Once they provide a token, store it — don't ask every time

Technical Analysis

The Skill explicitly instructs the Agent to persist an API token but does not identify an approved secret store or define storage permissions, encryption, redaction, retention, deletion, or rotation requirements.

Because the storage destination is unspecified, an implementation could place the token in conversation history, long-term Agent memory, plaintext configuration, logs, a workspace file, or another location accessible to unrelated tools or users. The instruction to avoid asking again encourages cross-session persistence and therefore increases the duration of exposure.

Sending the token to get_daily_brief is consistent with the declared authenticated brief-fetching functionality. The vulnerability is not the necessary authenticated request itself; it is the undefined method for retaining the credential. The reviewed document does not establish that the token is currently being exfiltrated or that a particular insecure storage backend is used.

Attack Path

1. The user supplies an Agent Vitamins API token to the Agent.
2. Following the instruction to “store it,” the Agent persists the token in an unspecified location.
3. A possible implementation records it in plaintext conversation memory, logs, configuration, or workspace storage.
4. Another session, local user, backup consumer, or tool with access to that storage retrieves the token.
5. The exposed token is ...[truncated 805 chars]

Remediation

View remediation

Remediation Suggestions

• Replace the generic instruction to “store it” with a requirement to use an operating-system keychain, dedicated secret manager, or MCP client's documented encrypted credential facility.
• Explicitly prohibit storing the token in prompts, conversation history, long-term Agent memory, logs, source-controlled files, or ordinary plaintext configuration.
• Inject the token into the MCP server only at runtime through a protected secret reference or narrowly scoped environment mechanism.
• Restrict secret-file permissions to the Agent account if file-based storage is unavoidable.
• Ensure logs and error reports redact the token and authorization headers.
• Document token revocation, rotation, expiration, and deletion procedures.
• Limit network transmission to the documented Agent Vitamins HTTPS API endpoint and prevent the credential from being forwarded to brief-provided links or other third parties.
• Request only a service-scoped token with the minimum permissions required to retrieve the full brief.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

MCP Config Access

High

• Category: Agent Snooping
• Confidence: 95% confidence

Finding

Skill accesses MCP server configuration files (mcp.json). MCP configs contain server URLs, authentication tokens, and tool definitions — reading them allows the skill to discover and potentially abuse other tool integrations.

Content

Scanner excerpt · SKILL.md (reported line 19)May include surrounding context.

1. Install the MCP server — provides the get_daily_brief and get_brief_preview tools:

Add to your MCP config (.claude/mcp.json or ~/.claude/mcp.json):

json

{
  "mcpServers": {

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill advertises very broad trigger phrases such as 'improve my agent', 'what's new for agents', and session-start check-ins, which can cause it to activate in many unrelated contexts. Because the skill fetches external recommendations and encourages later implementation of changes, unintended invocation can expose the agent to unnecessary external influence or prompt the user toward installing or adopting unvetted updates.

Content

No source excerpt is available for this finding.