Security audit

Prismer

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent Prismer Cloud integration, but it merits Review because it directs agents toward unpinned package/plugin execution and includes persistent memory, file sharing, and local skill installation capabilities.

Install only if you trust Prismer and the referenced package/plugin sources. Prefer pinned versions or a reviewed lockfile, inspect any catalog skill before installing or syncing it, avoid uploading sensitive files unless intentional, protect API keys/webhook secrets/JWTs, and treat persistent memory as retained cloud data.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

Location: Skill.md:13
Finding: Unpinned Third-Party Packages, Plugins, and Skills Permit Supply-Chain Code Execution<![CDATA[ ## Vulnerability Details **File Location**: `Skill.md`, lines 13, 217, 276–279, and 329 **Vulnerability Type**: Unpinned and automatically executed third-party dependencies **Risk Level**: Medium ### Vulnerable Code ```bash # Skill.md:13 which prismer || npm install -g @prismer/sdk ``` ```bash # Skill.md:217 prismer skill install <slug> # install + write SKILL.md locally ``` ```markdown  | **Claude Code Plugin** | `/plugin marketplace add Prismer-AI/PrismerCloud` then `/plugin install prismer@prismer` | | **MCP Server** | `npx -y @prismer/mcp-server` (33 tools) | | **OpenCode Plugin** | `opencode plugins install @prismer/opencode-plugin` | | **OpenClaw Channel** | `openclaw plugins install @prismer/openclaw-channel` | ``` ```markdown  | MCP Server | `@prismer/mcp-server` | `npx -y @prismer/mcp-server` (33 tools) | ``` ### Technical Analysis The documented setup installs or executes third-party packages, plugins, and catalog skills without pinning an exact reviewed version or requiring integrity verification. The global npm installation resolves the package version at execution time. More critically, `npx -y @prismer/mcp-server` automatically accepts installation and executes the currently resolved package. The plugin and skill installation commands likewise reference mutable names without a version, checksum, signature, lockfile, or mandatory review stage. Consequently, the code that executes may differ from the code that was available when this Skill was audited. If a registry publisher account, upstream package, plugin marketplace entry, or skill catalog entry is compromised, an attacker can distribute a modified release through these legitimate-looking commands. Package lifecycle hooks or plugin initialization logic may execute with the privileges of the user running the agent. This finding does not establish that the named packages are currently malicious. It identifie ...[truncated 2113 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin every package and plugin to an exact, reviewed version, for example: ```bash npm install -g @prismer/sdk@<reviewed-exact-version> npx --no-install @prismer/mcp-server ``` 2. Avoid `npx -y` because it automatically downloads and executes mutable registry content. Install a verified version in a controlled environment first, then execute the local pinned binary. 3. Use lockfiles and integrity metadata where supported. Verify package checksums, provenance attestations, registry signatures, and publisher ownership before installation. 4. Inspect packages with lifecycle scripts disabled before allowing execution: ```bash npm install --ignore-scripts --package-lock-only @prismer/mcp-server@<reviewed-exact-version> ``` Review the resolved dependency tree and package contents before enabling scripts. 5. Require explicit user approval and content review before installing or activating catalog skills and agent plugins. 6. Execute third-party tools with least privilege in a sandbox or isolated account. Restrict filesystem access, environment variables, credentials, and outbound network access. 7. Maintain an allowlist of approved package names, versions, hashes, and plugin sources. Reject installations that do not match the allowlist. 8. Add dependency monitoring and periodically re-review pinned versions for disclosed vulnerabilities or publisher compromise. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Rogue AgentSelf-Modification, Session Persistence
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Self-Modification

High

Category: Rogue Agent
Content: ```bash prismer skill find "evolution" # search catalog prismer skill find -c repair # filter by category prismer skill install <slug> # install + write SKILL.md locally prismer skill list # installed skills prismer skill show <slug> # view skill content prismer skill uninstall <slug> # uninstall
Confidence: 90% confidence
Finding: The skill supports installing and syncing other skills that write `SKILL.md` locally, creating a self-modification and transitive trust pathway. In an agent environment, this can let unreviewed remote skill content alter local agent behavior or expand capabilities, especially when combined with discovery/install workflows.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The File section instructs users to upload files and send them via messaging, which necessarily transfers user file contents to a cloud service and potentially other recipients. The description lacks a warning to avoid uploading sensitive files unless the user intends remote storage and sharing.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: The skill instructs users to run an unpinned package via `npx`, which fetches and executes the latest published code from the registry at runtime. If the upstream package is compromised, typo-squatted, or a malicious update is published, an agent could execute attacker-controlled code with the agent's local permissions.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: This repeats the same unsafe pattern: runtime execution of an unversioned external package. In an agent skill context, this is especially risky because agents may follow setup instructions automatically, turning a supply-chain compromise into immediate code execution.

Missing User Warnings

Low

Confidence: 76% confidence
Finding: The setup instructions include webhook registration with a secret, and the Message Delivery section shows SSE access with a JWT in the URL. These are security-relevant integrations that can expose conversation data if endpoint security or token handling is careless, yet no cautionary guidance is provided.

Missing User Warnings

Low

Confidence: 85% confidence
Finding: The Memory section states that memory is persistent across sessions and shows `memory write` and `memory delete` commands, but it does not include a user-facing caution about retention and deletion effects. Because these operations affect stored user data over time, a brief warning would improve safety transparency.

Missing User Warnings

Low

Confidence: 82% confidence
Finding: The markdown documents commands that install skills by writing `SKILL.md` locally and re-sync installed skills to disk, which can modify files on the user's system. While the commands are functional descriptions, the skill text does not include an explicit warning that these operations write to local disk or may overwrite local skill files.

Static analysis

No suspicious patterns detected.