Security audit

cpbox-suggest

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent paid autocomplete integration, but it deserves review because it encourages automatic paid network calls and an unpinned npx payment helper.

Install only if you are comfortable with a paid third-party autocomplete service receiving query text. Before using the x402 helper, prefer a pinned and reviewed package version, a restricted environment, and a dedicated low-balance wallet or explicit payment limits.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:55
Finding: Unpinned Third-Party Package Execution Through npx
Content: View full analysis
Remediation: View remediation
\ --url "https://www.cpbox.io/api/x402/suggest?q=albert&rich=true&count=10" \ --method GET ``` 2. Install the dependency through a package manifest and commit a lockfile so that both the direct dependency and its transitive dependencies are reproducible. 3. Verify package integrity using registry-provided integrity metadata or a separately published checksum. Revalidate the package before updating the pinned version. 4. Document the expected official registry and source repository to reduce dependency-confusion and registry-substitution risks. 5. Review the package and relevant transitive dependencies before approving upgrades, particularly code that interacts with wallets, signing APIs, environment variables, or local credential stores. 6. Run the payment client in a restricted environment with minimal filesystem and network access. 7. Use a dedicated wallet with limited funds, narrowly scoped signing authority, explicit transaction confirmation, and spending limits. Do not expose unrelated wallet seed phrases or private keys to the process. 8. Consider installing the verified package ahead of time and invoking the locked local binary instead of permitting runtime download and execution. ]]>

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (3)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The activation description is broad enough to match many generic autocomplete or suggestion requests, which can cause the agent to invoke this paid external skill more often than the user intended. In this context, over-triggering is risky because each invocation may initiate an x402 payment flow and send user query fragments to a third-party service.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 88% confidence
Finding: The documentation instructs users to run npx @springmint/x402-payment without pinning a specific package version. This creates a supply-chain risk because future package updates or a compromised published version could execute attacker-controlled code on the user's machine at invocation time.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The parameter table sets lang to a default of en, which imposes a language preference in the skill's documented behavior. The file does not state that users can opt in to that default or that the agent should preserve the user's existing language unless specified.
Content: No source excerpt is available for this finding.