Afrexai Cybersecurity Engine

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:19 AM UTC
• Version: 1.0.3

Overview

This security-audit skill is mostly purpose-aligned, but it gives broad command authority and includes unsafe remediation advice such as forced dependency fixes and running with administrator privileges.

Install only if you are comfortable with a security skill that can read project files and run commands. Use it in a sandbox or isolated repository, require command previews and explicit approval for any remediation, avoid npm audit fix --force unless reviewed, and do not run scans or build tools as administrator just to bypass permission errors.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:186

Finding

Unsafe Forced Dependency Remediation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:186
Vulnerability Type: Unsafe forced dependency modification
Risk Level: Medium

Vulnerable Snippet

text

If npm audit reports many high-severity vulnerabilities, prioritize Critical issues by CVSS. If an upgrade is unavailable, use npm audit fix --force or introduce a patch package.

Technical Analysis

The troubleshooting guidance recommends running npm audit fix --force. This option can install semver-major dependency changes and rewrite the dependency tree without confirming application compatibility. The alternative recommendation to introduce a patch package does not require a trusted source, pinned version, integrity verification, or security review.

Because the Skill declares command-execution capability, an agent could interpret this guidance as authorization to modify a repository automatically. Dependency audit output is not sufficient evidence that every proposed forced update is safe. Installation may also execute package lifecycle scripts such as preinstall, install, or postinstall.

Attack Path

1. A project contains vulnerable, outdated, compromised, or attacker-influenced dependency metadata.
2. npm audit returns high- or critical-severity findings.
3. The agent follows the recovery guidance and executes npm audit fix --force.
4. npm installs semver-major updates or otherwise substantially changes the resolved dependency graph.
5. An installed package may execute lifecycle scripts during installation.
6. Malicious package code can run with the privileges of the agent process, or incompatible dependency changes can compromise application integrity.
7. If the resulting lockfile or package manifest is committed or deployed without review, the change can propagate into CI and production environments.

Impact Assessment

Successful exploitation could execute dependency lifecycle code with the current agent user ...[truncated 534 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the recommendation to use npm audit fix --force as a routine recovery action.
• Default to npm audit fix without --force, followed by manual review of unresolved findings.
• Require explicit user approval before modifying dependency manifests or lockfiles.
• Perform dependency changes on a dedicated branch in an isolated, non-privileged environment.
• Use exact or appropriately constrained versions from an approved registry.
• Verify package provenance, integrity hashes, maintainers, release history, and changelogs.
• Disable package lifecycle scripts during initial inspection where practical, such as with npm install --ignore-scripts.
• Run unit, integration, security, and compatibility tests before accepting dependency changes.
• Review manifest and lockfile diffs before committing or deploying them.
• Permit patch packages only from approved sources and require integrity verification and documented ownership.

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:304

Finding

Generic Recommendation to Run Commands with Administrator Privileges

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:304
Vulnerability Type: Unnecessary privilege escalation
Risk Level: High

Vulnerable Snippet

text

Insufficient permissions | The current user lacks read or write access | Check file permissions and run as administrator

Technical Analysis

The troubleshooting table treats administrator execution as a generic response to insufficient filesystem permissions. It does not require identification of the resource involved, validation that elevated access is necessary, restriction of the elevated command, or explicit informed approval.

This conflicts with least-privilege principles. Security scanners and package-management tools can process attacker-controlled repository content, configuration, plugins, hooks, archives, and package lifecycle scripts. Running those tools as an administrator converts a localized permission problem into a potentially system-wide compromise opportunity.

The Skill declares exec access, so an agent following this instruction may rerun commands with elevated privileges rather than correcting narrowly scoped ownership or permission settings.

Attack Path

1. An attacker prepares a repository containing a malicious package lifecycle script, build hook, scanner plugin, configuration file, symbolic link, or other command-triggering content.
2. A scan or remediation command encounters a permission error, whether naturally or because the repository was arranged to trigger one.
3. The agent follows the troubleshooting guidance and reruns the command with administrator privileges.
4. The invoked tool loads or executes attacker-controlled repository content.
5. The malicious action inherits elevated privileges.
6. It can modify protected files, access administrator-readable data, tamper with system configuration, or install persistent components, depending on the operating system and elevation mechanism.

Impact Assessment

...[truncated 611 chars]

Remediation

View remediation

Remediation Suggestions

• Remove generic advice to run commands as an administrator.
• Require diagnosis of the exact file, directory, device, or network resource causing the permission failure.
• Correct ownership or grant only the minimum narrowly scoped permission needed for the task.
• Run scanners and build tools in an unprivileged container, virtual machine, or sandbox.
• Treat repository files, scanner configurations, plugins, hooks, and package scripts as untrusted before execution.
• Require an exact command preview, justification, affected-resource list, and explicit user confirmation before any elevation.
• Use tightly scoped privilege rules rather than an unrestricted administrator shell.
• Avoid preserving unnecessary environment variables when elevating.
• Record elevated operations in an audit log and terminate elevated privileges immediately after the approved action.
• Refuse elevation when the same result can be obtained by copying required files into an isolated workspace or changing a narrowly scoped permission.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill description uses very broad trigger language such as requests for security checks, compliance audits, vulnerability scanning, and encryption protection. In an agent ecosystem, this can cause the skill to activate for routine or ambiguous user requests, increasing the chance that a high-privilege skill with read and exec capabilities is invoked unnecessarily and performs risky analysis or commands without clear user intent.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The description explicitly says '支持中文交互' in a way that presents Chinese as the interaction mode, but it does not offer alternative language support or ask for user preference. This can violate language/locale policy expectations when a skill forces a specific language without opt-in.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill advertises file handling and command execution capabilities, including system command execution, but does not present a prominent user-facing warning that these actions may modify the system or access sensitive local resources. Because the skill also targets broad security-assessment scenarios, a user may invoke it expecting analysis only while the agent has authority to run commands, inspect files, or potentially alter the environment.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.