Security audit

trae-agent

Security checks for vulnerabilities and agentic risk

Overview

This skill is a broad repository agent that can guide multi-file edits and command execution, but it lacks clear user-control and safety boundaries for those high-impact actions.

Review before installing. This is not evidence of malware, but it gives an agent broad repository-editing and command-execution patterns without enough built-in guardrails. Use it only in trusted repositories, require explicit approval before edits or shell commands, run validations in a sandbox without secrets, and avoid copying the npx or command-string examples directly into production tooling.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: references/examples.md:317
Finding: Shell Command Injection Through an Unquoted Repository File Path
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: references/examples.md:317
Finding: Unpinned Third-Party Package Execution Through npx
Content: View full analysis
e.file.endsWith('.ts') || e.file.endsWith('.tsx'))) { steps.push({ type: 'typecheck', affectedFile: '*', command: 'npx tsc --noEmit', }); } ``` ### Technical Analysis Both validation commands invoke `tsc` through `npx` without requiring a preinstalled, reviewed local binary and without identifying a lockfile-pinned package version. Depending on the installed npm and npx version and its configuration, `npx` can resolve and download a package when an appropriate local executable is unavailable. This converts routine repository validation into a third-party code execution path. The command also assumes that the executable named `tsc` is the intended TypeScript compiler without verifying its package origin, version, or integrity. Although the project contains no malicious package declaration, this pattern creates a supply-chain risk when copied into an implementation or executed in an environment where the expected compiler is absent or dependency resolution has been manipulated. ### Attack Path 1. The agent validates a TypeScript edit in an environment where the intended local `tsc` binary is missing or cannot be resolved. 2. The generated validation step runs `npx tsc`. 3. `npx` resolves the executable using its configured local, cache, registry, or package-resolution behavior. 4. An unintended, compromised, or substituted package is obtained or selected. 5. Third-party package code executes with the same privileges, filesystem access, environment variables, and network access as the agent. An a ...[truncated 802 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Behavioral ASTexec() Call, eval() Call, Dynamic Import
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 28)May include surrounding context.
md
> 📎 **Code example 1** (typescript) — see [references/examples.md](references/examples.md)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 95)May include surrounding context.
md
> 📎 **Code example 1** (typescript) — see [references/examples.md](references/examples.md)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The invocation description is extremely broad ('repository-level code understanding', 'multi-file editing', 'natural language to code execution') and provides no clear trigger boundaries or safety constraints. That makes it easy for an orchestrator or user to invoke a highly capable skill in situations where a narrower, safer tool should be used, increasing the chance of unintended code execution or repository-wide changes.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill explicitly advertises execution surfaces ('Docker sandbox, Jupyter, Bash') together with repository modification capabilities, but does not warn about command execution, secrets exposure, filesystem impact, or data loss. In a repository agent context, this is more dangerous because users may assume analysis-only behavior while the skill is positioned to run commands and alter many files.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: Listing 'Delete - Remove code safely' normalizes destructive modification without any explicit caution, approval gate, or backup/rollback requirement. In a repository-wide agent, deletion can remove business logic, tests, or security controls across multiple files, so the absence of warnings and guardrails materially increases operational risk.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The example shows automatic applyEdit, rollbackEdit, and alternative edit generation across repository files without any explicit user-consent, dry-run, or warning boundary. In a repository-level code agent, silent write capability is security-relevant because prompt-driven or malformed planning can alter sensitive files, introduce backdoors, or destroy code at scale.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The example defines validation as free-form shell commands (command: string) and later executes them through runValidation(validation), enabling arbitrary command execution if validation steps are influenced by untrusted inputs or generated content. In a repository agent context, this is more dangerous because the agent already processes natural-language tasks and code context, making command injection or unsafe command selection a realistic failure mode.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The example includes subprocess-style validation commands (npx tsc, npm run lint, npm test) but provides no warning, consent flow, or trust boundary for executing code from the target repository. This is dangerous because build and test scripts are attacker-controlled in untrusted repositories and can execute arbitrary code on the host when the agent runs validation.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.