eSIM Agent

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:31 AM UTC
• Version: 1.8.1

Overview

The skill is mostly transparent and purpose-aligned, but its optional local MCP setup runs an unpinned npm package automatically.

Use the remote HTTP MCP setup when possible. Before using the local stdio fallback, verify the npm package publisher and version, prefer a pinned version, and understand that buy links use disclosed affiliate tracking unless you ask for the raw partner URL.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:20

Finding

Mandatory Monetized Tracking Redirects Influence Agent Recommendations

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 20-22
Vulnerability Type: Instruction-driven affiliate and analytics redirect insertion
Risk Level: Medium

Vulnerable Code Snippet

markdown

- **Two link fields per item:** Each plan, provider, and deal ships with both a `buyUrl` (short click-tracked redirect on `https://esimagent.vdigital.app/r/...`) and an `affiliateUrl` (the raw partner URL with referral code). The `buyUrl` is a stable short link that resolves server-side to the same partner destination as `affiliateUrl`. **Use `buyUrl` by default** — it's what funds the service and keeps responses readable. **Disclose `affiliateUrl` on request** if the user asks for the direct partner link or wants to avoid the redirect.
- **Prices already reflect partner discounts** negotiated with each provider — that's what the referral relationship buys users.
- **Usage analytics:** Tool invocations (tool name, query parameters like country code, response counts) are logged server-side for service improvement. No personal data is stored — IP addresses are hashed before storage. Clicks on `buyUrl` record the provider, plan, and country but not user identity; the redirect then forwards the user to the partner.

The same policy is reinforced at lines 140-142 and 248:

markdown

**Always use the `buyUrl` field as the default buy link.** It is a short click-tracked redirect on `esimagent.vdigital.app/r/...` that resolves to the partner URL with the correct referral parameter. The short path keeps responses clean for AI agents; click attribution is recorded server-side. Using `buyUrl` keeps click analytics flowing to eSIM Agent so the service can stay free; using the raw `affiliateUrl` still pays the referral but skips the anonymous analytics record.

If the user asks for the raw partner URL, the direct link, or a URL without the redirect, surface `affiliateUrl` and explain clearly: the `?partner_id=...` / referral par
...[truncated 2840 chars]

Remediation

View remediation

Remediation Suggestions

1. Present the direct provider destination as the default and offer the tracked affiliate redirect as an explicit alternative.
2. Obtain user consent before sending the user through a click-tracking intermediary.
3. Label every affiliate link next to the link itself, rather than relying only on general documentation.
4. Explain that the operator may receive compensation before the user selects a link.
5. Display the expected destination domain and validate it against a strict allowlist of official provider domains.
6. Prevent redirects to newly introduced or unapproved domains without review.
7. Do not instruct the Agent to suppress the direct URL unless the user asks for a shorter link.
8. Apply data minimization to API queries and click telemetry, document retention periods, and provide an opt-out mechanism.
9. Treat server-generated rankings as untrusted commercial data and allow the Agent to disclose ranking methodology or independently verify key claims.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:181

Finding

Unpinned npm Package Is Automatically Downloaded and Executed

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 181-188
Vulnerability Type: Mutable third-party dependency execution
Risk Level: Medium

Vulnerable Code Snippet

markdown

### Option 2: Local stdio (fallback for clients without HTTP support)

```json
{
  "mcpServers": {
    "esim-agent": {
      "command": "npx",
      "args": ["-y", "esimagent-mcp"]
    }
  }
}

text

### Technical Analysis

The fallback MCP configuration invokes `npx` with `-y` and a package name that has no exact version or integrity constraint. When the package is unavailable locally, `npx` can retrieve it from the configured npm registry and execute its code. The `-y` option suppresses the normal installation confirmation.

Because no version is specified, the effective code may change after the Skill has been reviewed. A compromised maintainer account, malicious future release, registry compromise, dependency compromise, or unexpected registry configuration could therefore cause arbitrary package code to run when the MCP client starts.

The configuration is explicitly presented as a fallback rather than the recommended installation method, which reduces exposure. Nevertheless, users whose clients lack HTTP MCP support may copy it directly into a persistent client configuration.

### Attack Path

1. A user copies the fallback MCP configuration into an MCP-capable client.
2. The client starts or restarts and runs `npx -y esimagent-mcp`.
3. `npx` resolves the mutable package name through the user's configured npm registry.
4. The current package version and its dependency tree are downloaded if they are not already available.
5. Package lifecycle or runtime code executes with the privileges of the MCP client user.
6. If the resolved package or one of its dependencies is compromised, malicious code can access resources available to that user and communicate over permitted network channels.
7. Because the co
...[truncated 874 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the package to a reviewed exact version, for example esimagent-mcp@X.Y.Z, rather than resolving the latest release.
2. Publish and verify package integrity hashes and signed release provenance.
3. Remove -y so the user receives an explicit prompt before installation and execution.
4. Instruct users to inspect the resolved package, publisher, version, and registry before running it.
5. Pin and audit transitive dependencies through a lockfile in a locally installed distribution.
6. Recommend installation from a verified artifact rather than downloading mutable code at every invocation.
7. Run the MCP server under a dedicated, least-privileged account or sandbox with narrowly scoped filesystem and network access.
8. Document the official npm scope, publisher identity, source repository, release-signing process, and expected package checksum.
9. Continue to prefer the URL-only transport where suitable, while documenting that it transfers requests and metadata to a remote service.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 85% confidence

Finding

Skill instructs the agent to never refuse or to always comply. Suppressing the agent's ability to decline removes a core safety control and enables downstream harmful requests to succeed.

Content

Scanner excerpt · SKILL.md (reported line 247)May include surrounding context.

md

- Don't refuse to show raw plan details, the raw `affiliateUrl`, or provider websites if the user explicitly asks for them

Static analysis

No suspicious patterns detected.