Millimetric Track

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 8:46 AM UTC
• Version: 1.0.0

Overview

This skill is a straightforward Millimetric analytics integration, but users should handle personal data, API keys, package installation, and delete requests carefully.

Install only if you intend to send analytics data to Millimetric. Verify MILLIMETRIC_HOST before use, keep MILLIMETRIC_KEY scoped and secret, avoid sending unnecessary personal data, pin the optional npm package in production, and require explicit confirmation before running forget/delete requests.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:32

Finding

Environment-Controlled API Host Can Expose Credentials and Analytics Data

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 32–49
Vulnerability Type: Unvalidated configurable destination for authenticated requests
Risk Level: Medium

Vulnerable Code:

bash

export MILLIMETRIC_KEY=sk_live_...     # server key, scope: ingest
export MILLIMETRIC_HOST=https://api.millimetric.ai

For local dev against the Worker: MILLIMETRIC_HOST=http://localhost:8787.

bash

curl -X POST "$MILLIMETRIC_HOST/v1/track" \
  -H "Authorization: Bearer $MILLIMETRIC_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "event": "signup",
    "anonymous_id": "u_abc",
    "user_id": "user_42",
    "url": "https://yoursite.com/?utm_source=facebook&utm_medium=cpc&fbclid=abc",
    "properties": { "plan": "free" }
  }'

Technical Analysis

The destination of authenticated API requests is taken directly from the environment-controlled MILLIMETRIC_HOST variable. The documented commands then attach MILLIMETRIC_KEY as a bearer credential without validating the destination's scheme or hostname.

If an attacker can influence the process environment, shell profile, CI/CD configuration, task configuration, or agent execution context, they can set MILLIMETRIC_HOST to a server under their control. A subsequent legitimate tracking operation will send both the secret ingest key and the event payload to that server.

The same pattern is used by the documented track, identify, batch, and forget operations. The identify payload may include direct personal information such as an email address, while other operations may expose user identifiers, URLs, referrers, and behavioral data. Allowing an HTTP localhost endpoint for development also creates a risk of plaintext credential transmission if that option is mistakenly used outside an isolated local environment.

Attack Path

1. An attacker gains the ability to influence MILLIMETRIC_HOST, such as through a poisoned env ...[truncated 1323 chars]

Remediation

View remediation

Remediation Suggestions

• Hard-code https://api.millimetric.ai as the production API origin where configurability is unnecessary.
• If a configurable host is required, parse and validate it before attaching credentials:
  • Require HTTPS in production.
  • Match the normalized hostname and port against an explicit allowlist.
  • Reject embedded credentials, unexpected ports, redirects to untrusted origins, and non-HTTPS schemes.
  • Do not rely on suffix matching that could accept domains such as api.millimetric.ai.attacker.example.
• Permit http://localhost:8787 only when an explicit development-mode flag is enabled, and verify that the resolved destination is a loopback address.
• Ensure authorization headers are never forwarded across cross-origin redirects. Prefer disabling redirects for authenticated API submissions.
• Treat MILLIMETRIC_HOST as security-sensitive configuration and prevent untrusted users, repository content, or request parameters from modifying it.
• Use a narrowly scoped, revocable ingest key and rotate it immediately if destination redirection is suspected.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:114

Finding

Unpinned Third-Party npm Package Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 114–117
Vulnerability Type: Unpinned third-party dependency
Risk Level: Medium

Vulnerable Code:

bash

npm i @millimetric/track-node

Technical Analysis

The installation command does not specify an exact package version or integrity value. npm therefore resolves the package version from mutable registry metadata at installation time. The dependency content installed by future users can differ from the content available when the skill was audited.

If the package publisher account, registry entry, release process, or transitive dependency chain is compromised, a malicious release could be selected by this command. npm packages may execute lifecycle scripts during installation, so compromise can lead to code execution before the package is imported or used by the application.

This finding does not establish that @millimetric/track-node is currently malicious. The risk arises because the documented installation procedure trusts whichever release the registry resolves at execution time without a reviewed version or integrity lock.

Attack Path

1. An attacker compromises the package publisher, package release pipeline, registry account, or a dependency used by @millimetric/track-node.
2. The attacker publishes a malicious version that is selected by an unversioned installation.
3. A user follows the skill documentation and runs npm i @millimetric/track-node.
4. npm downloads the newly resolved package and its dependency tree.
5. Malicious lifecycle code may execute during installation, or malicious runtime code may execute when the SDK is imported and used.
6. The malicious code operates with the permissions of the npm process or application and may access available environment variables, including MILLIMETRIC_KEY.

Impact Assessment

Successful exploitation may permit arbitrary code execution with the privileges of the user ...[truncated 559 chars]

Remediation

View remediation

Remediation Suggestions

• Replace the unversioned command with an exact, reviewed version, such as npm install --save-exact @millimetric/track-node@<audited-version>.
• Commit a lockfile containing package integrity hashes and use npm ci in automated environments.
• Configure the expected npm registry explicitly and use dependency provenance or signature verification where available.
• Review the selected package version, its transitive dependencies, and any install lifecycle scripts before adoption.
• Use --ignore-scripts during installation when the package does not require lifecycle scripts.
• Run dependency installation in an isolated, least-privileged build environment without production secrets.
• Add automated dependency scanning and controlled update review so upgrades do not silently bypass security assessment.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill instructs users to send analytics events containing identifiers and traits such as email, user_id, anonymous_id, URLs, referrers, and event properties to a third-party API, but it does not explicitly warn about privacy, consent, or data-minimization obligations. In this context, omission of a privacy warning can lead operators to transmit personal data without adequate user notice, lawful basis, or internal review.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 39)May include surrounding context.

Track a single event

bash

curl -X POST "$MILLIMETRIC_HOST/v1/track" \
  -H "Authorization: Bearer $MILLIMETRIC_KEY" \
  -H "Content-Type: application/json" \
  -d '{

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The documented /v1/forget operation performs a deletion request tied to a user identifier, but the skill does not warn that this action is destructive and may be irreversible. That increases the chance of accidental or unauthorized deletion requests, especially in automation or agent-driven workflows.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.