T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:16- Finding
Mandatory External Completion Gate Hijacks Agent Workflow
- Content
View full analysis
- Remediation
View remediation
Security audit
Aport Complete
Security checks for vulnerabilities and agentic risk
Overview
This skill is a disclosed APort completion-check workflow, but it sends task details to an external service and gives that service control over whether the agent may call work complete.
Install only if you intentionally want APort to act as a remote completion gate. Do not use it on confidential code, customer data, regulated work, or secrets unless your organization has approved APort as a third-party processor and you know exactly which fields will be sent. Prefer a pinned, verified setup method over the unpinned `npx` command.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (4)
other
Error
- Location
SKILL.md:41- Finding
Potential Disclosure of Full Task Output and Metadata to an External Service
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:31- Finding
Unpinned Third-Party Package Execution Through npx
- Content
View full analysis
- Remediation
View remediation
T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:31- Finding
Agent Is Directed to Follow Mutable Remote Instructions
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 92% confidence
- Finding
The skill directs agents to run
npx aport-idwithout pinning a version or integrity-verified package source. That creates a supply-chain risk: a future malicious or compromised package version could be executed automatically in a privileged agent environment.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill explicitly instructs agents to include
output_contentand send it to a remote verification API when scanning is enabled, but it provides no consent gate, redaction guidance, or user-facing warning. In an agent context, this can exfiltrate proprietary code, sensitive documents, secrets, or regulated data to a third party during normal task completion flow.- Content
Unbounded Resource Access
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.
- Content
md - `oap.criteria_not_met` → attempt to resolve the criterion, then retry Maximum retries: 3. After 3 denials on the same task, surface the issue to the user. Do not loop indefinitely. ## Links
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 92% confidence
- Finding
This is the same unpinned
npx aport-idreference repeated in the links section, so it carries the same supply-chain execution risk. Repetition increases the chance an agent or operator will follow the unsafe invocation path.- Content
Static analysis
No suspicious patterns detected.