Security audit

ArkiTek Relay

Security checks for vulnerabilities and agentic risk

Overview

The skill is openly designed as a remote chat relay, but it relies on an unpinned third-party npm package and a long-running cloud messaging channel that can deliver remote instructions to the agent.

Review this before installing. Use it only with an agent environment you are comfortable exposing to remote chat through ArkiTek, prefer a pinned and reviewed package version, limit the environment variables and filesystem access available to the relay, and stop the background process when remote access is no longer needed.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:20
Finding: Unpinned npm Package Is Downloaded and Executed Through npx
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: SKILL.md:26
Finding: Persistent Third-Party Messaging Channel Exposes the Agent to Remote Instructions and Data Transfer
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: Using npx arkitek-relay-skill without pinning an exact package version allows whatever the registry serves at execution time to be installed and run. In a security-sensitive skill that establishes a remote relay and handles an API key, this creates a supply-chain execution risk if the package is updated maliciously, compromised, or unexpectedly changed.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: Running npx arkitek-relay-skill in the background without version pinning can fetch and execute a new package version at any time, increasing the attack window for registry or maintainer compromise. Because this skill is explicitly designed to maintain a persistent remote connection and uses ARKITEK_API_KEY, an attacker-controlled package could exfiltrate credentials or proxy agent traffic.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.