Agentderby

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 5:15 AM UTC
• Version: 0.3.6

Overview

This skill is a disclosed AgentDerby canvas tool that reads the board, posts chat, and draws pixels only when invoked.

Install this only if you want an agent to connect to AgentDerby and publish visible chat or pixel changes when you ask it to. Use continuous execution/demo loops cautiously because their effects are public, even though no hidden local persistence, credential access, or exfiltration behavior was found.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

*     the event listener
       * @param {Boolean} [options.once=false] A `Boolean` indicating that the
       *     listener should be invoked at most once after being added. If `true`,
       *     the listener would be automatically removed when invoked.
       * @public
       */
      addEventListener(type, handler, options = {}) {

• Confidence: 80% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

*     any of the `'message'`, `'ping'`, and `'pong'` events can be emitted
       *     multiple times in the same tick
       * @param {Boolean} [options.autoPong=true] Specifies whether or not to
       *     automatically send a pong in response to a ping
       * @param {Number} [options.backlog=511] The maximum length of the queue of
       *     pending connections
       * @param {Boolean} [options.clientTracking=true] Specifies whether or not to

• Confidence: 80% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The exported skill exposes draw_pixel, draw_pixels, and draw_pixels_chunked functions that directly modify a shared public board once the caller invokes them, but the code itself contains no built-in confirmation, dry-run safeguard, scope restriction, or user-facing warning before performing writes. In a collaborative shared-canvas context, this makes accidental or misuse-driven tampering easier, especially because higher-level autonomous planning/execution helpers in the same bundle are designed to select regions and execute patches programmatically.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"build": "node scripts/build.mjs"
  },
  "dependencies": {
    "pngjs": "^7.0.0",
    "ws": "^8.18.0"
  },
  "devDependencies": {

• Confidence: 97% confidence
• Finding: The dependency uses a caret range (^7.0.0), which allows installation of newer minor/patch releases rather than a single audited version. This weakens build reproducibility and can unexpectedly pull in a compromised or vulnerable release through the supply chain, though by itself it does not prove compromise in this package.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

},
  "dependencies": {
    "pngjs": "^7.0.0",
    "ws": "^8.18.0"
  },
  "devDependencies": {
    "esbuild": "^0.25.5"

• Confidence: 98% confidence
• Finding: The ws dependency is not pinned to an exact version, so installations may resolve to different releases over time. Because ws has had multiple security advisories, leaving the version range open increases supply-chain and patch-level uncertainty and makes it harder to verify whether deployed builds are safe.

Unverifiable Dependency: ws has 7 known advisory(ies) (CVE-2016-10518 (Remote Memory Disclosure in ws); CVE-2024-37890 (ws affected by a DoS when handling a request with many HTTP headers); CVE-2026-45736 (ws: Uninitialized memory disclosure) +4 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 95% confidence
• Finding: The manifest does not pin ws to an exact version, and ws has several known advisories across versions. That means the actual installed version cannot be reliably assessed from this file alone, creating a real risk that vulnerable releases could be resolved in some environments; in an agent skill that uses WebSockets for coordination, a ws issue could affect network-facing behavior and availability/confidentiality.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"ws": "^8.18.0"
  },
  "devDependencies": {
    "esbuild": "^0.25.5"
  }
}

• Confidence: 93% confidence
• Finding: The devDependency esbuild is specified with a caret range, which permits automatic drift across builds. Even though it is a development tool, compromised or vulnerable build-time tooling can affect produced artifacts or developer environments, so the lack of pinning is a real but low-severity supply-chain weakness.

Unverifiable Dependency: esbuild has 2 known advisory(ies) (GHSA-67mh-4wv8-2f99 (esbuild enables any website to send any requests to the development server and r); GHSA-g7r4-m6w7-qqqr (esbuild allows arbitrary file read when running the development server on Window)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 86% confidence
• Finding: esbuild has known advisories in some versions, and because the dependency is not pinned, the effective installed version is unverifiable from the manifest. The risk is lower here because esbuild is a devDependency and the cited issues primarily relate to development server behavior, but it still creates avoidable exposure in developer or CI environments.

Static analysis

No suspicious patterns detected.