Security audit

ArkiTek Relay

Security checks for vulnerabilities and agentic risk

Overview

The skill is openly designed as a remote chat relay, but it relies on an unpinned third-party npm package and a long-running cloud messaging channel that can deliver remote instructions to the agent.

Review this before installing. Use it only with an agent environment you are comfortable exposing to remote chat through ArkiTek, prefer a pinned and reviewed package version, limit the environment variables and filesystem access available to the relay, and stop the background process when remote access is no longer needed.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:20
Finding: Unpinned npm Package Is Downloaded and Executed Through npx<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:4, 20-24` **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: Medium ### Vulnerable Code ```yaml metadata: {"openclaw": {"requires": {"env": ["ARKITEK_API_KEY"], "bins": ["node", "npx"]}, "primaryEnv": "ARKITEK_API_KEY", "emoji": "📡", "homepage": "https://arkitekai.com", "install": [{"id": "npm", "kind": "node", "package": "arkitek-relay-skill", "bins": ["arkitek-relay-skill"], "label": "Install ArkiTek Relay (npm)"}]}} ``` ```markdown 3. Start the relay by running: ```text npx arkitek-relay-skill ``` ``` ### Technical Analysis The skill directs users to execute `arkitek-relay-skill` through `npx` without specifying an exact package version or an integrity digest. Depending on the local npm configuration and whether the package is already installed, `npx` can retrieve the current package release from an npm registry and immediately execute it. The effective executable code is not included in the audited project. Therefore, its behavior cannot be inspected or tied to the reviewed `SKILL.md`. The package contents may change after this skill has been reviewed. The project also provides no lockfile, package integrity value, trusted-registry restriction, or vendored source code. This creates a supply-chain trust boundary: compromise of the package publisher, registry account, package distribution process, or a future package release could cause different code to execute under the same documented command. ### Attack Path 1. An attacker compromises the npm publisher account, package release process, or configured package registry. 2. The attacker publishes a modified version of `arkitek-relay-skill`. 3. A user follows the skill instructions and runs `npx arkitek-relay-skill`. 4. `npx` downloads and executes the attacker-controlled package version. 5. The package runs with the permissions of the invoking user or agent process. 6. The malicious package may read accessible enviro ...[truncated 790 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin the dependency to an exact, reviewed version rather than executing an unspecified current release. 2. Record and verify the expected package integrity digest. 3. Include a lockfile and enforce deterministic dependency resolution. 4. Prefer vendoring the reviewed relay source code into the skill so the executable implementation is included in the audit boundary. 5. Restrict package retrieval to an explicitly trusted registry. 6. Review package lifecycle scripts and disable them where they are not required. 7. Run the relay in a sandbox, container, or restricted operating-system account with minimal filesystem and network permissions. 8. Expose only `ARKITEK_API_KEY` to the relay process rather than inheriting the agent's complete environment. 9. Establish a controlled update process in which new package releases are reviewed before deployment. ]]>

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: SKILL.md:26
Finding: Persistent Third-Party Messaging Channel Exposes the Agent to Remote Instructions and Data Transfer<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:26-33, 37-42` **Vulnerability Type**: `T05: Unauthorized Access and Privilege Escalation` **Risk Level**: Medium ### Vulnerable Code ```markdown The skill will connect to ArkiTek and listen for messages. When a user sends a message from the ArkiTek UI, it arrives here. Your response is sent back to ArkiTek automatically. ## When to use this skill - Use this skill when you want to connect to ArkiTek so users can chat with you remotely - Run `npx arkitek-relay-skill` in the background to maintain the connection - The connection auto-reconnects if it drops ``` ```markdown ArkiTek Web UI ←→ ArkiTek Cloud ←——SSE—— Your Agent (this skill) (user) (relay) ——POST→ All connections are outbound from the agent. Nothing is exposed on the agent's network. ``` ### Technical Analysis The documented behavior establishes a persistent outbound connection to a third-party cloud relay, receives remotely supplied messages as agent input, and automatically sends agent responses back to that service. Background execution and automatic reconnection extend the duration of this externally reachable instruction channel. The audited artifact does not include the relay implementation. Consequently, the audit cannot verify: - How remote users are authenticated and authorized. - Whether access is isolated to the intended agent and account. - Whether message provenance is exposed to the agent. - Whether remote messages are treated as untrusted input. - Whether sensitive responses are filtered before transmission. - Whether high-impact agent tool operations require local approval. - How API keys, sessions, logs, and message content are protected. The behavior is not proof that ArkiTek authentication is absent. However, it creates a security-sensitive access-control boundary whose implementation is outside the reviewed project. If the associated account, session, relay service, or API key is co ...[truncated 1729 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Require explicit local user approval before starting the relay. 2. Enforce strong authentication and per-agent authorization for every remote sender. 3. Clearly label remote messages as untrusted external input and preserve verifiable sender provenance. 4. Require separate local confirmation before filesystem access, command execution, credential use, network actions, or other sensitive tool operations. 5. Apply least-privilege controls so the connected agent can access only the tools and data required for remote chat. 6. Redact secrets and sensitive context before transmitting responses to the external service. 7. Provide configurable session expiration, idle timeouts, a visible connection indicator, and an immediate stop mechanism. 8. Avoid indefinite background execution unless explicitly enabled and periodically reauthorized. 9. Maintain security audit logs for connection events, authenticated senders, message delivery, and sensitive actions without recording API keys or confidential message content. 10. Document what message content, agent context, metadata, and logs are transmitted to or retained by ArkiTek. 11. Include the relay implementation in the audit scope so its authentication, TLS validation, key handling, logging, and authorization claims can be independently verified. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: Using `npx arkitek-relay-skill` without pinning an exact package version allows whatever the registry serves at execution time to be installed and run. In a security-sensitive skill that establishes a remote relay and handles an API key, this creates a supply-chain execution risk if the package is updated maliciously, compromised, or unexpectedly changed.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: Running `npx arkitek-relay-skill` in the background without version pinning can fetch and execute a new package version at any time, increasing the attack window for registry or maintainer compromise. Because this skill is explicitly designed to maintain a persistent remote connection and uses `ARKITEK_API_KEY`, an attacker-controlled package could exfiltrate credentials or proxy agent traffic.

Static analysis

No suspicious patterns detected.