RedPincer — AI Red Team Suite

• Outcome: Review
• Latest audit: Sep 11, 2026 · 12:57 AM UTC
• Version: 1.0.0

Overview

The skill describes a legitimate LLM security-testing tool, but installing it requires running mutable external code that was not included in the reviewed package.

Review the external GitHub repository and its package scripts before installing, preferably pinning a specific audited commit. Run it in a restricted local environment, avoid exposing the dashboard beyond localhost unless you add authentication and network controls, and only test LLM systems you own or are authorized to assess.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:23

Finding

Unpinned Remote Code Retrieval and Execution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 23-29
Vulnerability Type: Remote Payload Retrieval and Execution
Risk Level: High

bash

# Clone and install
git clone https://github.com/rustyorb/pincer.git {baseDir}/redpincer
cd {baseDir}/redpincer
npm ci

# Run
npm run dev

Technical Analysis

The installation instructions clone the mutable default branch of an external GitHub repository without pinning a reviewed commit hash, signed release, or immutable source archive. The downloaded implementation is not included in the audited artifact, which contains only SKILL.md. Therefore, the effective code executed by this skill cannot be verified from the submitted project and may change after review.

After retrieval, npm ci installs dependencies and may execute package lifecycle scripts. The subsequent npm run dev command executes a script defined by the remotely retrieved package. These commands can run arbitrary code with the permissions of the user following the instructions.

This is primarily a remote payload retrieval risk. It also creates a dependency supply-chain exposure because the external project and its npm dependency graph are outside the reviewed artifact.

Attack Path

1. An attacker compromises the referenced GitHub repository, its maintainer account, or a dependency used by the repository.
2. The attacker modifies the default branch, package scripts, dependency lockfile, or an installed package lifecycle script.
3. A user follows the documented Quick Start instructions and clones the modified content.
4. npm ci executes malicious dependency lifecycle behavior, or npm run dev executes a malicious package script.
5. The payload runs under the user's account and can access resources available to that account.

Impact Assessment

Successful exploitation could provide arbitrary code execution with the invoking user's privileges. Depending on the environment, ...[truncated 385 chars]

Remediation

View remediation

Remediation Suggestions

• Include the reviewed implementation directly in the skill package where practical.
• Pin the Git repository to a specific audited commit hash or cryptographically verified signed release.
• Publish and verify checksums or signatures for downloaded source archives.
• Commit and review the dependency lockfile, and use automated dependency and provenance scanning.
• Use npm ci --ignore-scripts when dependency lifecycle scripts are not required.
• Review all required lifecycle scripts before enabling them explicitly.
• Run the application in a restricted container or low-privilege account with minimal filesystem, credential, and network access.
• Establish an update process that requires security review before changing the pinned source revision.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:33

Finding

Production Dashboard Exposed on All Network Interfaces

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 33-36
Vulnerability Type: Unsafe Network Binding
Risk Level: Medium

bash

For production:
```bash
npm run build
npx next start -H 0.0.0.0 -p 3000

Technical Analysis

The documented production command binds the Next.js application to 0.0.0.0, making the service listen on every available network interface. The documented workflow handles LLM endpoint configuration, API keys, attack results, and security reports, but the audited artifact does not specify authentication, TLS, firewall restrictions, or a secured reverse proxy.

Binding to all interfaces is not inherently a vulnerability when appropriate access controls exist. In this skill, however, it is presented as the default production command without corresponding deployment protections. This can unintentionally expose the dashboard to other systems on a local, cloud, container, or public network.

The use of npx also adds execution uncertainty if the expected local binary is unavailable, because npx can offer to obtain and execute a package from the npm registry. The primary confirmed issue at this location is the broad network binding.

Attack Path

1. A user starts the production dashboard with the documented command.
2. The process listens on TCP port 3000 across all network interfaces.
3. Host firewall rules, container port publication, or cloud security-group settings permit another host to reach that port.
4. An unauthorized network peer connects to the dashboard.
5. The peer accesses exposed functionality or attempts to exploit application-level weaknesses in the externally retrieved implementation.

Impact Assessment

The direct scope is unauthorized network reachability to the dashboard. Potentially exposed assets include testing configuration, target endpoint information, assessment results, and application functions.

The documentation claims that API keys remai ...[truncated 345 chars]

Remediation

View remediation

Remediation Suggestions

• Bind to 127.0.0.1 by default:

  bash

  npx next start -H 127.0.0.1 -p 3000
  

• Require explicit administrator opt-in before listening on external interfaces.
• Place remotely accessible deployments behind an authenticated reverse proxy.
• Enforce TLS for all non-local connections.
• Restrict port 3000 with host firewalls, container network policy, and cloud security groups.
• Document whether the dashboard implements authentication and authorization; require them when multiple users or remote access are supported.
• Avoid displaying or returning full API keys through the user interface.
• Prefer an explicitly installed, version-pinned local executable over an unqualified npx invocation.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 89% confidence

Finding

The production start command uses npx next start, which can cause npx to resolve and execute a package version that is not explicitly pinned if the local binary is unavailable or the environment differs from expectations. In a security tool context, users may run these setup commands verbatim, so an unexpected package fetch or binary substitution could introduce supply-chain risk or lead to execution of unreviewed code.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.