AgentWyre

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 1:08 AM UTC
• Version: 1.0.0

Overview

This skill is a straightforward AgentWyre API helper, with a notable caution around its optional unpinned MCP server setup.

Installing the skill for its included Python helper is low risk if you are comfortable making read-only requests to agentwyre.ai. Treat AGENTWYRE_API_KEY as a secret, use a scoped and revocable key, and avoid the optional npx MCP setup unless you pin and review the agentwyre-mcp package source or run it in a restricted environment.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:64

Finding

Unpinned npm Package Is Downloaded and Executed with Access to an API Key

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 64–73
Vulnerability Type: Unpinned third-party dependency execution
Risk Level: Medium

json

{
  "mcpServers": {
    "agentwyre": {
      "command": "npx",
      "args": ["agentwyre-mcp"],
      "env": { "AGENTWYRE_API_KEY": "your_key" }
    }
  }
}

Technical Analysis

The documented MCP configuration invokes npx agentwyre-mcp without specifying an exact package version, integrity hash, lockfile, verified publisher, or reviewed source reference. If the package is not already installed locally, npx can retrieve it from the npm registry and immediately execute it. Consequently, the code that runs may change after the Skill has been reviewed.

The launched package is also explicitly given AGENTWYRE_API_KEY. Any malicious or compromised package release—and potentially malicious code in its dependency tree—would execute with the local user's permissions and could read and exfiltrate that credential.

This behavior is not required for the core helper script, which uses only Python standard-library modules. It therefore introduces avoidable supply-chain exposure beyond the minimum privileges needed to query the declared API.

Attack Path

1. An attacker compromises the agentwyre-mcp npm package, its publisher account, or a transitive dependency, or causes an unsafe package version to be published.
2. A user adopts the MCP configuration from SKILL.md.
3. The MCP client invokes npx agentwyre-mcp.
4. npx downloads the currently resolved package version when a trusted local copy is unavailable.
5. The downloaded package executes under the user's account and receives AGENTWYRE_API_KEY in its environment.
6. Malicious package code can read and exfiltrate the API key, access files available to the user, make network requests, or perform other actions permitted to that process.

Impact Assessment

Successful exploitation could expose the AgentWyre API credential and permi ...[truncated 577 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin agentwyre-mcp to an explicitly reviewed, immutable version rather than resolving the latest available release.
2. Install the dependency through a committed lockfile and use deterministic installation, such as npm ci, instead of allowing npx to download code at runtime.
3. Verify package provenance, publisher identity, repository ownership, release signatures or attestations, and registry integrity metadata before installation.
4. Prefer invoking a previously installed and reviewed local binary with automatic package downloading disabled.
5. Review and lock transitive dependencies, and use automated dependency scanning to detect compromised or vulnerable releases.
6. Provide the API key only after package authenticity has been established. Use a narrowly scoped, revocable credential and avoid exposing unrelated environment variables to the process.
7. Run the MCP server in a restricted environment with minimal filesystem and network access where practical.
8. Document the official source repository and approved package checksum or integrity value so users can validate the installed artifact.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (3)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 21)May include surrounding context.

bash

# Get today's free signals (no key needed)
curl -s https://agentwyre.ai/api/feed/free | python3 -m json.tool

# Get full feed (requires API key)
curl -s -H "Authorization: Bearer $AGENTWYRE_API_KEY" https://agentwyre.ai/api/feed

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill uses network access and an environment variable for authentication, but it does not declare any tool scope or permission boundaries. This can cause an agent runtime to grant broader capabilities than intended, increasing the chance of unintended outbound requests or exposure of sensitive API-key-backed behavior.

Content

No source excerpt is available for this finding.

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · scripts/agentwyre.py (reported line 103)May include surrounding context.

python

def cmd_status(_args):
    data = api("/api/status", auth=False)
    print(f"Status: {data.get('status', '?')}")
    print(f"Service: {data.get('service', '?')}")
    if KEY: