Security audit

Aport Handoff

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its handoff purpose, but it tells agents to follow mutable remote instructions and recommends unpinned external execution, so it should receive human review before installation.

Install only after reviewing the remote-instruction and setup paths. Prefer the web setup flow or a pinned, verified CLI version; do not let an agent blindly follow https://aport.id/skill as executable instructions. Before saving or posting handoffs, redact secrets and sensitive project details, confirm the recipient and channel are approved, and store local copies only where retention is acceptable.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:29
Finding: Untrusted Remote Instructions Are Retrieved and Followed
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: SKILL.md:32
Finding: Unpinned npm Package Is Executed Through npx
Content: View full analysis
Remediation: View remediation
`. - Verify the package's authoritative publisher, source repository, and release provenance before recommending execution. - Prefer installation through a committed lockfile with npm integrity metadata. - Verify package signatures, provenance attestations, or a published cryptographic digest where supported. - Use a trusted, explicitly configured registry and prevent project or user configuration from silently redirecting package resolution. - Run the tool in a sandbox or least-privilege environment without unnecessary credentials, sensitive environment variables, or broad filesystem access. - Review the resolved package and its dependency tree before updating the pinned version. - Avoid automatic execution when a browser-based or locally audited implementation can provide the same functionality. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (4)

Rp1

Medium

Category: MCP Rug Pull
Confidence: 87% confidence
Finding: The skill tells users to run npx aport-id without pinning a specific package version or integrity source. Because npx fetches the latest published package by default, a compromised maintainer account, malicious update, or dependency hijack could cause arbitrary code execution on the user's machine or agent host.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The skill encourages delivering handoff content through GitHub, Slack, Discord, or messaging tools without any general warning about confidentiality, audience scope, retention, or third-party exposure. Since the handoff can include project status, evidence strings, decision IDs, and contextual notes, posting it externally or broadly could leak sensitive operational or business information.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The skill mandates saving a local copy of the handoff document but does not warn that the document may contain sensitive project details, internal identifiers, recipient information, or decision evidence. This can create unnecessary data at rest on local disks or shared workspaces, increasing the chance of accidental disclosure, persistence beyond need, or pickup by other tools and agents.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 87% confidence
Finding: This repeats the same unsafe instruction to execute npx aport-id without a pinned version. Unpinned npx execution allows remote code retrieval at runtime, which increases supply-chain risk and could lead to arbitrary code execution if the package or its dependency chain is compromised.
Content: No source excerpt is available for this finding.