Agent Card

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:36 AM UTC
• Version: 1.0.1

Overview

The skill is coherent and not malicious, but it asks agents to manage real payment cards through mutable installs and has some under-scoped handling of financial metadata.

Review this before installing because it can let an agent create spend-capable virtual cards, access full card details when requested, and interact with checkout flows. Prefer pinned, trusted installation of the CLI, avoid sudo, verify the MCP endpoint and publisher, and ask the agent to confirm before listing cards, creating funded cards, revealing PAN/CVV, or performing payment-related actions.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: README.md:8

Finding

Unpinned Third-Party Packages Are Retrieved and Executed

Content

View full analysis

Vulnerability Details

File Location: README.md:8-11, README.md:37-42, references/setup.md:5-7, and SKILL.md:12-16
Vulnerability Type: Unpinned and mutable third-party dependencies
Risk Level: Medium

Vulnerable Code

README.md:8-11:

bash

npx skills add tiny-agent-company/agent-card-skill

README.md:37-42:

text

1. Install the skill (non-interactive):
   npx skills add tiny-agent-company/agent-card-skill -y

2. Install the CLI (non-interactive):
   npm install -g agent-cards

references/setup.md:5-7:

bash

npm install -g agent-cards

SKILL.md:12-16:

yaml

install:
  - kind: node
    package: agent-cards
    bins: [agent-cards]

Technical Analysis

The installation instructions retrieve mutable third-party packages without specifying an exact package version, immutable source revision, integrity hash, or signature. The effective code installed by these commands can therefore change after the skill has been audited.

npx may download and execute package code from the configured npm registry. Similarly, npm install -g agent-cards installs the latest version selected by npm and may execute package lifecycle scripts during installation. Global installation also makes the resulting executable available throughout the user's environment.

This does not prove that the referenced packages are malicious. It creates a supply-chain risk in which compromise of a publishing account, registry artifact, upstream repository, or transitive dependency could turn the documented setup process into a code-execution channel.

Attack Path

1. An attacker compromises the npm publisher, source repository, registry artifact, or an unpinned transitive dependency.
2. The attacker publishes a malicious release under the expected package name.
3. A user or agent follows the documented npx or npm install -g instructions.
4. The package manager res ...[truncated 787 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin every npm package to a reviewed exact version rather than relying on the latest compatible release.
2. Where a repository is installed directly, use an immutable commit hash instead of a mutable branch or tag.
3. Publish expected integrity hashes or signed release provenance and document how users can verify them.
4. Use package-lock or equivalent lock data for any maintained Node.js project containing dependencies.
5. Avoid global installation where possible. Prefer a project-local, least-privileged installation.
6. Evaluate whether installation can use --ignore-scripts; if lifecycle scripts are required, document and audit them explicitly.
7. Recommend installation from a non-administrative account and warn users not to use sudo.
8. Document the expected package publisher, version, checksum, and executable behavior so users can detect substitution or compromise.

T05 · Unauthorized Access and Privilege Escalation

Note

• Location: SKILL.md:59

Finding

Ambiguous Requests Trigger Unnecessary Financial Account Enumeration

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:59-61
Vulnerability Type: Excessive access to sensitive financial metadata
Risk Level: Low

Vulnerable Code

markdown

### Orientation

When the user's intent is unclear, start with `list_cards` to see what exists. Use card IDs from responses in subsequent calls.

Technical Analysis

The skill instructs the agent to call list_cards specifically when user intent is unclear. According to the documented tool definition, this operation returns card IDs, last four digits, expiration data, balances, and card status.

Although the MCP service may authorize the operation through OAuth, authorization alone does not establish that retrieving this information is necessary for an ambiguous request. The instruction conflicts with least-privilege and data-minimization principles because it favors sensitive account enumeration over first asking the user to clarify their objective.

The returned information does not include full PAN or CVV according to the documentation, but it remains sensitive financial metadata. Once retrieved, it may enter the agent context, conversation logs, tool traces, or other telemetry associated with the host environment.

Attack Path

1. A user makes an ambiguous request while the AgentCard MCP integration is authenticated.
2. Following the skill instruction, the agent invokes list_cards without first confirming that account enumeration is needed.
3. The remote service returns card identifiers, last four digits, expiration information, balances, and statuses.
4. That data is incorporated into the agent session or tool logs.
5. Any party or component with access to those logs or the session gains financial metadata that was not required by the original request.

Impact Assessment

The direct impact is unnecessary disclosure of financial account metadata within the agent execution environment. Exposed data may reveal the num ...[truncated 431 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the automatic list_cards instruction with a requirement to ask a clarifying question when user intent is ambiguous.
2. Call list_cards only after the user explicitly requests card information or confirms that listing cards is necessary.
3. State what metadata will be retrieved before invoking the tool and obtain confirmation where appropriate.
4. Return only fields necessary for the user's stated task and avoid reproducing card IDs or expiration information unless needed.
5. Redact sensitive identifiers from conversation summaries and logs where the host platform supports redaction.
6. Add a general data-minimization rule requiring the least sensitive tool to be selected for each operation.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (4)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The README prominently advertises card creation, credential access, and payments but does not provide an upfront warning about financial consequences, cardholder-data sensitivity, or the need for explicit user confirmation before exposing credentials or initiating spending. In a payment-card skill, missing user-facing safeguards materially increases the chance of accidental charges, overbroad delegation, or inappropriate handling of PAN/CVV by downstream agents.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The skill metadata allows use of npx to obtain or run tooling without pinning a specific version, which introduces a supply-chain risk: a future or compromised package version could be fetched and executed unexpectedly. In this skill's context, that risk is amplified because the tool manages payment cards and can expose sensitive financial data or perform payment-related actions if a malicious dependency is executed.

Content

No source excerpt is available for this finding.