agent-bom scan

• Outcome: Review
• Latest audit: Sep 18, 2026 · 11:24 AM UTC
• Version: 0.105.0

Overview

The skill is a disclosed security scanner, but its default discovery model can read many sensitive agent and developer configuration files from a user's home directory without clear per-source consent.

Review before installing if you have sensitive agent, MCP, or cloud configuration files in your home directory. Use targeted commands such as package checks, image scans, or explicit SBOM scans when possible, and avoid broad discovery scans unless you are comfortable with the tool reading the disclosed local configuration paths.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (10)

Agent Config Directory Access

High

• Category: Agent Snooping

Content

- "~/Library/Application Support/Claude/claude_desktop_config.json"
      - "~/.config/Claude/claude_desktop_config.json"
      # Claude Code
      - "~/.claude/settings.json"
      - "~/.claude.json"
      # Cursor
      - "~/.cursor/mcp.json"

• Confidence: 93% confidence
• Finding: The skill declares reads from agent configuration locations such as ~/.claude/settings.json, which may contain MCP server definitions, local paths, endpoints, and potentially sensitive operational details. Even if intended for inventory and security scanning, reading cross-tool config files materially expands access to user environment metadata and can expose secrets if redaction is incomplete.

Agent Config Directory Access

High

• Category: Agent Snooping

Content

# VS Code Copilot
      - "~/Library/Application Support/Code/User/mcp.json"
      # Codex CLI
      - "~/.codex/config.toml"
      # Gemini CLI
      - "~/.gemini/settings.json"
      # Goose

• Confidence: 92% confidence
• Finding: Access to ~/.codex/config.toml is sensitive because CLI agent configuration can reveal MCP endpoints, local filesystem locations, tokens, or trust settings. A security scanner with broad automatic discovery increases the blast radius if it is invoked accidentally or if its redaction logic misses edge cases.

Agent Config Directory Access

High

• Category: Agent Snooping

Content

# Codex CLI
      - "~/.codex/config.toml"
      # Gemini CLI
      - "~/.gemini/settings.json"
      # Goose
      - "~/.config/goose/config.yaml"
      # Continue

• Confidence: 92% confidence
• Finding: Reading ~/.gemini/settings.json can expose local tool configuration, remote service endpoints, and possibly embedded authentication or project metadata. Because this skill is designed to discover agents broadly, the context makes the file access more sensitive than ordinary package scanning.

Agent Config Directory Access

High

• Category: Agent Snooping

Content

# Goose
      - "~/.config/goose/config.yaml"
      # Continue
      - "~/.continue/config.json"
      # Zed
      - "~/.config/zed/settings.json"
      # Roo Code

• Confidence: 92% confidence
• Finding: The declared access to ~/.continue/config.json enables inspection of another agent tool's configuration, which may include model endpoints, local paths, and secrets or secret-adjacent metadata. Cross-application config harvesting is risky in a skill that can be triggered broadly and may run in environments containing many developer credentials.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: The skill advertises broad trigger phrases such as "verify" and "is this safe," which are generic enough to cause unintended invocation in unrelated contexts. Over-broad activation increases the chance that the skill is run on sensitive local files or environments when the user did not specifically request this scanner.

External Transmission

Medium

• Category: Data Exfiltration

Content

- "user-provided SBOM files (CycloneDX/SPDX JSON)"
    file_writes: []
    network_endpoints:
      - url: "https://api.osv.dev/v1"
        purpose: "OSV vulnerability database — batch CVE lookup for packages"
        auth: false
      - url: "https://services.nvd.nist.gov/rest/json/cves/2.0"

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

- url: "https://services.nvd.nist.gov/rest/json/cves/2.0"
        purpose: "NVD CVSS v4 enrichment — optional API key increases rate limit"
        auth: false
      - url: "https://api.first.org/data/v1/epss"
        purpose: "EPSS exploit probability scores"
        auth: false
      - url: "https://api.github.com/advisories"

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

- url: "https://api.first.org/data/v1/epss"
        purpose: "EPSS exploit probability scores"
        auth: false
      - url: "https://api.github.com/advisories"
        purpose: "GitHub Security Advisories — supplemental CVE lookup"
        auth: false
    telemetry: false

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The when-to-use examples include ambiguous phrases like "is this safe" without strong scope restrictions, which can cause the agent to invoke the skill for vague trust decisions rather than explicit software scanning tasks. In an agent setting, that ambiguity can expand access to local config discovery and network lookups beyond what the user intended.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

- Show CVEs even when NVD analysis is pending or severity is `unknown` — a CVE ID is still a real finding.
- Treat `UNKNOWN` severity as unresolved, not benign — it means data is not yet available.
- Do not modify any files, install packages, or change system configuration.
- Only public package names and CVE IDs leave the machine for vulnerability database lookups.
- Ask before scanning paths outside the user's home directory.

• Confidence: 60% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Static analysis

No suspicious patterns detected.