Security audit

Agent Identity Kit

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent agent-card toolkit, but its validator can fetch unpinned dependencies and contains a fallback path that can execute attacker-controlled code from crafted file paths.

Review before installing or running this skill in CI or on untrusted agent.json files. Prefer using a preinstalled, pinned validator, avoid the Python fallback, and do not run validate.sh on paths supplied by someone else until the path handling and dependency installation behavior are fixed.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/validate.sh:58
Finding: Arbitrary Python Code Execution Through Unsafely Interpolated File Paths
Content: View full analysis
Remediation: View remediation
".join(str(p) for p in exc.absolute_path)) sys.exit(1) PY ``` Additional hardening should include: - Avoiding dynamically generated source code entirely. - Running validation with the least privileges required. - Testing filenames containing quotes, spaces, newlines, shell metacharacters, and Unicode characters. - Keeping dependency installation separate from file validation. - Adding automated regression tests proving that unusual paths are treated strictly as data. ]]>

T08 · Insecure Dependencies

Warning

Location: scripts/validate.sh:31
Finding: Automatic Retrieval and Execution of Unpinned Registry Dependencies
Content: View full analysis
/dev/null; then echo "🔍 Validating $FILE against Agent Card v1 schema..." echo "" if ajv validate -s "$SCHEMA" -d "$FILE" --spec=draft7; then echo "" echo "✅ Valid agent.json!" else echo "" echo "❌ Validation failed. Fix the errors above and try again." exit 1 fi elif command -v npx &> /dev/null; then echo "🔍 Validating $FILE against Agent Card v1 schema..." echo " (Using npx ajv-cli — may take a moment on first run)" echo "" if npx ajv-cli validate -s "$SCHEMA" -d "$FILE" --spec=draft7; then echo "" echo "✅ Valid agent.json!" else echo "" echo "❌ Validation failed. Fix the errors above and try again." exit 1 fi elif command -v python3 &> /dev/null; then echo "🔍 Validating $FILE against Agent Card v1 schema..." echo "" python3 -c " import json, sys try: from jsonschema import validate, ValidationError except ImportError: print('Installing jsonschema...') import subprocess subprocess.check_call([sys.executable, '-m', 'pip', 'install', 'jsonschema', '-q']) from jsonschema import validate, ValidationError ``` The behavior is also disclosed only briefly in the documentation: ```markdown Validates the file against `schema/agent.schema.json`. Requires `ajv-cli` (auto-installs if missing). ``` ### Technical Analysis When a globally installed `ajv` binary is unavailable, the script invokes: ```bash npx ajv-cli ``` No version or integrity hash is specified. Depending on local npm and `npx` behavior, this can retrieve the current package release and execute its code immediately. The Python fallback similarly installs an unpinned package into the active Python environment: ```python subprocess.check_call([ ...[truncated 1934 chars]
Remediation: View remediation
--hash=sha256: ``` 5. Fail safely with installation instructions if dependencies are missing. 6. Avoid silently modifying the user's active Python environment. 7. Review transitive dependencies and enable automated dependency scanning. 8. In CI, use a prebuilt environment or immutable container containing the reviewed validator. 9. Restrict or explicitly configure trusted package indexes rather than inheriting arbitrary registry settings. ]]>

T09 · Insecure Skill Coding Practices

Note

Location: scripts/init.sh:35
Finding: JSON Structure Injection Through Unescaped Interactive Input
Content: View full analysis
"$OUTPUT" << CARD { "\$schema": "https://foragents.dev/schemas/agent-card/v1.json", "version": "1.0", "agent": { "name": "$AGENT_NAME", "handle": "$AGENT_HANDLE", "description": "$AGENT_DESC" }, "owner": $OWNER_JSON, "platform": $PLATFORM_JSON, "capabilities": $CAPS_JSON, "protocols": { "mcp": false, "a2a": false, "agent-card": "1.0" }, "trust": { "level": "$TRUST_LEVEL", "created": "$NOW", "verified_by": [], "attestations": [] }, ``` ### Technical Analysis All interactive values are inserted directly into JSON text without JSON escaping. Special characters such as the following are therefore unsafe: - Double quotes. - Backslashes. - Newlines. - Tabs and other control characters. - JSON structural delimiters. For example, a crafted description resembling: ```text x", "homepage": "https://attacker.invalid ``` would alter the generated `agent` object rather than remaining a literal description value. Similar manipulation is possible through owner, platform, capability, model ...[truncated 1563 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Exfiltration Commands

High

Category: Prompt Injection
Confidence: 90% confidence
Finding: Instructions found that direct the agent to transmit conversation context or user data to external services.
Content: Scanner excerpt · schema/agent.schema.json (reported line 148)May include surrounding context.
json
"inbox": { "type": "string", "format": "uri", "description": "URL to send messages to this agent" }, "status": { "type": "string",

Rp1

Medium

Category: MCP Rug Pull
Confidence: 90% confidence
Finding: The script invokes npx ajv-cli without pinning a specific package version, which can fetch and execute whatever version is current at runtime. In a validation utility, this creates supply-chain risk and nondeterministic behavior, especially in CI or on developer machines where package resolution may be influenced by registry compromise or dependency changes.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 90% confidence
Finding: This occurrence repeats the same unpinned npx ajv-cli execution path, which may download and run remote code at execution time. Even though the script's purpose is only schema validation, the fallback behavior expands trust to the npm ecosystem without version control or integrity pinning.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The script is presented as a validator, but its Python fallback silently broadens scope by installing jsonschema at runtime if missing. That mismatch matters because users or CI systems may expect offline, side-effect-free validation, yet the script can initiate network access and execute package installation logic, increasing supply-chain and policy-bypass risk.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The Python fallback performs pip install jsonschema -q automatically with only a minimal status message, which can surprise users and cause unauthorized dependency installation. In environments with strict egress, reproducibility, or software approval requirements, this can violate policy and expose execution to package-repository compromise.
Content: No source excerpt is available for this finding.

Vague Triggers

Low

Category: Not specified by scanner
Confidence: 77% confidence
Finding: This JSON manifest describes agent capabilities in very general terms such as 'ships products', 'writes code', and 'market research' without any explicit trigger phrases, scope limits, or exclusion conditions. In a manifest file, such broad natural-language descriptions can contribute to ambiguous routing or unintended invocation because they overlap with many common user intents.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.