Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node src/index.js marcas
Security audit
Tabela FIPE
Security checks for vulnerabilities and agentic risk
Overview
This is a straightforward Brazilian vehicle price lookup skill that calls a public FIPE API, with dependency-maintenance and broad-trigger notes but no hidden or privileged behavior found.
Before installing, expect Portuguese CLI output and outbound requests to the public FIPE API. Keep dependencies updated or install deterministically from the lockfile, and consider narrowing activation to explicit FIPE-related requests if accidental activation matters in your agent setup.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (14)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node src/index.js marcas
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node src/index.js marcas
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node src/index.js marcas
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node src/index.js marcas
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node src/index.js marcas
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node src/index.js marcas
Known Vulnerable Dependency: axios==1.13.6 — 16 advisory(ies): CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-44495 (axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollut); CVE-2025-62718 (Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF) +13 more
High
- Category
- Supply Chain
- Confidence
- 93% confidence
- Finding
The lockfile pins axios to 1.13.6, and the finding lists multiple advisories including SSRF/proxy-handling issues and prototype-pollution-related MITM/credential theft scenarios. Even though this file alone does not prove the vulnerable code paths are exercised, including a version with numerous known advisories is a real supply-chain risk, especially for an agent skill that may make outbound HTTP requests.
- Content
Known Vulnerable Dependency: form-data==4.0.5 — 1 advisory(ies): CVE-2026-12143 (form-data: CRLF injection in form-data via unescaped multipart field names and f)
High
- Category
- Supply Chain
- Confidence
- 87% confidence
- Finding
form-data 4.0.5 is reported vulnerable to CRLF injection via unescaped multipart field names and filenames. If any part names or filenames are influenced by external input, an attacker may smuggle additional headers or alter multipart request structure, which can lead to request manipulation against downstream services.
- Content
Known Vulnerable Dependency: axios==1.13.6 — 16 advisory(ies): CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-44495 (axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollut); CVE-2025-62718 (Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF) +13 more
High
- Category
- Supply Chain
- Confidence
- 89% confidence
- Finding
The package allows axios versions matching ^1.6.0, and the static finding indicates resolution to axios 1.13.6, which is reported as having multiple known advisories including SSRF-related and prototype-pollution-assisted attack paths. If this skill makes outbound HTTP requests using attacker-influenced URLs, headers, proxy settings, or redirect behavior, these flaws could expose credentials, enable request forgery, or permit response manipulation.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The trigger phrases include generic vehicle-related language such as "preço carro", "valor carro", and informal phrasing like "carro tá quanto", which can overlap with normal conversation outside a deliberate skill invocation. This can cause accidental activation or misrouting of user intent, especially in assistants that rely on fuzzy trigger matching, though the skill’s domain is low-risk and informational.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The user-facing strings throughout the CLI, including errors, help text, and formatted results, are written only in Portuguese. This can violate language or locale policy when the skill forces a specific language without user opt-in, and the file does not clearly document that the skill is restricted to Portuguese-speaking users.
- Content
Known Vulnerable Dependency: follow-redirects==1.15.11 — 1 advisory(ies): CVE-2026-40895 (follow-redirects leaks Custom Authentication Headers to Cross-Domain Redirect Ta)
Low
- Category
- Supply Chain
- Confidence
- 84% confidence
- Finding
follow-redirects 1.15.11 is flagged for leaking custom authentication headers across cross-domain redirects. In a skill that performs HTTP requests, this can expose API keys, bearer tokens, or other sensitive headers to an unintended host if redirects are followed automatically.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 98% confidence
- Finding
The dependency is specified with a caret range ("^1.6.0"), which permits installation of newer minor and patch releases rather than a single fixed version. This weakens build reproducibility and can unintentionally pull in a newly vulnerable or incompatible release during installation, increasing supply-chain risk.
- Content
json "start": "node src/index.js" }, "dependencies": { "axios": "^1.6.0" } }