Agent-to-agent chat over Fluxra

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:59 AM UTC
• Version: 0.1.1

Overview

The skill has a coherent Fluxra chat purpose, but it asks users to run an unpinned third-party CLI and MCP server with limited scoping or safety guidance.

Review this skill before installing. Use a pinned, trusted Fluxra CLI version if possible, avoid running the MCP server in a privileged environment, confirm recipients and message contents before sending, and do not send secrets or sensitive regulated data through Fluxra unless you understand the service and its data handling.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:16

Finding

Unpinned Third-Party CLI Installation and Execution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:16-19, SKILL.md:39-42, SKILL.md:85-88, SKILL.md:145-148, README.md:14-17, README.md:57-60, README.md:64-70, examples.md:75-78, and examples.md:85-88
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

The skill instructs users or agents to install and execute @fluxra-ai/fluxra-cli without pinning an exact package version, verifying package integrity, or providing a dependency lockfile. The repository contains no implementation of the referenced CLI, so the behavior of the downloaded package cannot be established from the audited files.

Vulnerable Code

SKILL.md:16-19:

bash

npm install -g @fluxra-ai/fluxra-cli

SKILL.md:39-42:

bash

npx @fluxra-ai/fluxra-cli schema

SKILL.md:85-88:

bash

npx @fluxra-ai/fluxra-cli mcp serve

SKILL.md:145-148:

bash

fluxra help:all
fluxra auth whoami
fluxra chat send agt_xxx "hello"
fluxra chat sync once
npx @fluxra-ai/fluxra-cli schema

README.md:14-17:

bash

npm install -g @fluxra-ai/fluxra-cli

README.md:57-60:

bash

npx @fluxra-ai/fluxra-cli mcp serve

README.md:64-70:

json

{
  "mcpServers": {
    "fluxra": {
      "command": "npx",
      "args": ["@fluxra-ai/fluxra-cli", "mcp", "serve"]
    }
  }
}

examples.md:75-78:

bash

npx @fluxra-ai/fluxra-cli schema

examples.md:85-88:

bash

npx @fluxra-ai/fluxra-cli mcp serve

Technical Analysis

An unversioned npm package reference resolves according to the package registry's current distribution tags rather than to a release reviewed with this skill. Consequently, the effective executable can change after the skill itself has been audited.

The npx commands can download and immediately execute the resolved package when it is not already available locally. The global installation command al ...[truncated 2443 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the dependency to an exact reviewed release in every installation and execution example, rather than relying on the registry's current default version.

2. Replace unversioned npx usage with an explicitly versioned invocation, such as:

   bash

   npm exec --package=@fluxra-ai/fluxra-cli@EXACT_VERSION -- fluxra schema
   

   Use the command syntax verified for the selected release.

3. Add a package manifest and committed lockfile with integrity metadata where practical. Use reproducible installation such as npm ci instead of an unpinned global installation.

4. Verify npm package provenance, publisher identity, signatures or attestations, and registry integrity metadata before approving upgrades.

5. Establish an update process in which each new version is reviewed and tested before documentation changes permit its execution.

6. Avoid global installation where possible. Run the CLI under a dedicated, least-privileged account or isolated environment with restricted filesystem and network access.

7. Do not expose the MCP server to untrusted clients or networks. Bind it only to the required interface and constrain the permissions and credentials available to its process.

8. Document the expected package version and checksum so operators can detect unexpected dependency changes.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (10)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The README instructs users to run an MCP server via npx @fluxra-ai/fluxra-cli without pinning a specific package version. Because npx may fetch the latest published package at execution time, a compromised upstream release or malicious dependency update could cause arbitrary code execution on the host where the MCP server is launched. In an agent skill context, this is more dangerous because MCP servers are commonly granted broad local tool access and may run in trusted automation environments.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill enables sending messages, syncing inboxes, and exposing MCP tools over the Fluxra network, but it does not prominently warn that these actions transmit data off-host to an external service. In an agent context, lack of disclosure can lead users to send sensitive prompts, identifiers, or inbox contents to a third-party network without informed consent.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence

Finding

The skill instructs users to launch an MCP server via npx @fluxra-ai/fluxra-cli mcp serve without pinning an exact package version. Unpinned npx execution can pull whatever version is current at execution time, creating supply-chain and reproducibility risk if a compromised or incompatible release is published.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

This reference again tells the agent to execute npx @fluxra-ai/fluxra-cli without a pinned version. Because MCP servers are long-running and may gain access to user data and tool invocations, pulling an unexpected package version increases the blast radius of a malicious or breaking upstream release.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 88% confidence

Finding

The reference section repeats an unpinned npx @fluxra-ai/fluxra-cli schema command. Even though this is presented as a help/schema operation, it still executes remote package code and therefore carries the same supply-chain risk as the other npx usages.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The example phrase for sending messages is broad and resembles normal conversational requests, which can cause the skill to activate unexpectedly when a user is speaking generally rather than intentionally invoking this capability. In an agent-to-agent chat skill, accidental activation could send messages to the wrong recipient or leak information into direct or group conversations.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The phrase Check my messages is a vague everyday request that could match many benign conversational contexts, increasing the chance of unintended skill activation. In this skill, activation would query inbox state and surface message content, which can expose potentially sensitive communications to the wrong context or interface.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The setup trigger Setup Fluxra for me is broad and maps to commands that create a profile and register/authenticate an agent, which are state-changing actions involving identity and account configuration. Because the activation phrase is not tightly scoped, a casual request could unintentionally trigger registration or profile changes, leading to misconfiguration, unwanted account creation, or exposure of personal details such as email addresses.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The example invokes npx @fluxra-ai/fluxra-cli without pinning a specific package version, which means execution depends on whatever version is current at runtime. If the package is compromised, updated incompatibly, or a dependency is poisoned, users may execute unexpected code when following the example, and npx increases that risk because it fetches and runs packages directly.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

Starting an MCP server via npx @fluxra-ai/fluxra-cli mcp serve without pinning the package version can cause users to download and execute unreviewed code at the moment they expose local tooling through a server interface. In this context the risk is elevated because MCP server functionality may expose capabilities, credentials, or local resources to connected clients if the fetched package is malicious or altered.

Content

No source excerpt is available for this finding.