Security audit

Agentscope Skill

Security checks for vulnerabilities and agentic risk

Overview

This AgentScope guide is mostly coherent documentation, but it deserves review because it promotes mutable updates and unsandboxed shell/Python execution in basic examples.

Review before installing or using broadly. Treat the skill as documentation plus runnable examples, not just passive help. Do not follow the shell/Python execution examples on a machine with secrets unless you add a sandbox, confirmation prompts, and a minimal environment. Prefer pinned AgentScope versions or reviewed commit hashes instead of git-pulling main, and update example dependencies before running the A2UI client examples.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:47
Finding: LLM-Accessible Shell and Python Tools Permit Unrestricted Host Code Execution
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:137
Finding: Mutable and Unpinned Installation Workflow Creates Supply-Chain Exposure
Content: View full analysis
=1.13", "numpy", "openai", "python-datauri", "opentelemetry-api>=1.39.0", "opentelemetry-sdk>=1.39.0", "opentelemetry-exporter-otlp>=1.39.0", "opentelemetry-semantic-conventions>=0.60b0", "python-socketio", "shortuuid", "tiktoken", "sounddevice", "sqlalchemy", "python-frontmatter", "aiofiles", ] ``` ### Technical Analysis The referenced PyPI project and GitHub repository are official AgentScope sources; the audit found no evidence of typosquatting or a deliberately malicious dependency. The weakness is that the installed and cloned content is mutable and is not cryptographically bound to the version reviewed during this audit. `pip install agentscope` resolves the current package release and transitive dependency graph at execution time. Most dependencies have no exact version constraint, and the instructions do not require a lockfile or verified hashes. Therefore, identical installation commands can produce mater ...[truncated 2162 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (570)

Context-Inappropriate Capability

Critical

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The declared purpose is informational and assistive around the AgentScope framework, not remote system administration or command execution. Advertising a skill that executes shell commands on the server introduces a powerful capability that is not an obvious or necessary requirement for answering usage questions or finding library examples.
Content: No source excerpt is available for this finding.

Known Vulnerable Dependency: shell-quote==1.8.3 — 2 advisory(ies): CVE-2026-13311 (shell-quote: Quadratic-complexity Denial of Service in `parse()` (CWE-407)); CVE-2026-9277 (shell-quote quote() does not escape newlines in object .op values)

Critical

Category: Supply Chain
Confidence: 90% confidence
Finding: Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Critical

Category: Not specified by scanner
Confidence: 98% confidence
Finding: A skill meant to help users build applications with AgentScope or answer library questions does not inherently require arbitrary shell command execution on the server. This capability is highly sensitive and unrelated to the manifest's described purpose.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The declared description presents this as a knowledge/help skill about using the AgentScope Python library. The supplied code, however, is an operational shell script for building documentation artifacts. Its primary purpose is not answering questions about AgentScope or searching framework examples/APIs, but cleaning directories and generating HTML docs with Sphinx. The filesystem deletion and build automation are undeclared capabilities and materially differ from the stated purpose.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The declared purpose describes an informational/help skill for the AgentScope library, focused on answering questions and guiding usage. The supplied code does not implement help, search, examples, or library-usage assistance. Instead, it is an operational shell script for building Chinese documentation and cleaning build artifacts on the filesystem. This is a materially different primary purpose and includes filesystem-modifying behavior that is not reflected in the description.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 280)May include surrounding context.
md
- `view_pypi_latest_version.sh`: View the latest version of AgentScope on PyPI.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 285)May include surrounding context.
md
- `view_module_signature.py`: Explore the structure of AgentScope modules, classes, and methods.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 304)May include surrounding context.
md
- **`multi_agent_orchestration.md`**: Multi-agent orchestration concepts and implementation

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 305)May include surrounding context.
md
- **`deployment_guide.md`**: Deployment patterns and best practices

Hidden Instructions

High

Category: Prompt Injection
Confidence: 70% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · agentscope/README.md (reported line 81)May include surrounding context.
md
## News  - **[2026-02] `FEAT`:** Realtime Voice Agent support. [Example](https://github.com/agentscope-ai/agentscope/tree/main/examples/agent/realtime_voice_agent) | [Multi-Agent Realtime Example](https://github.com/agentscope-ai/agentscope/tree/main/examples/workflows/multiagent_realtime) | [Tutorial](https://doc.agentscope.io/tutorial/task_realtime.html) - **[2026-01] `COMM`:** Biweekly Meetings launched to share ecosystem updates and development plans - join us! [Details & Schedule](https://github.com/agentscope-ai/agentscope/discussions/1126) - **[2026-01] `FEAT`:** Database support & memory compression in memory module. [Example](https://github.com/agentscope-ai/agentscope/tree/main/examples/functionality/short_term_memory/memory_compression) | [Tutorial](https://doc.agentscope.io/tutorial/task_memory.html)

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 95% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · agentscope/docs/tutorial/en/build.sh (reported line 6)May include surrounding context.
sh
set -e # Clean old build files rm -rf build/ doctrees/ # Build the html sphinx-build -M html ./ build

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 95% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · agentscope/docs/tutorial/zh_CN/build.sh (reported line 6)May include surrounding context.
sh
set -e # Clean old build files rm -rf build/ doctrees/ # Build the html sphinx-build -M html ./ build

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 95% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · agentscope/docs/tutorial/en/build.sh (reported line 12)May include surrounding context.
sh
sphinx-build -M html ./ build # Remove temporary files (double insurance) rm -rf build/html/.doctrees rm -f build/html/.buildinfo find build/html -name "*.pickle" -delete find build/html -name "__pycache__" -delete

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 95% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · agentscope/docs/tutorial/zh_CN/build.sh (reported line 12)May include surrounding context.
sh
sphinx-build -M html ./ build # Remove temporary files (double insurance) rm -rf build/html/.doctrees rm -f build/html/.buildinfo find build/html -name "*.pickle" -delete find build/html -name "__pycache__" -delete

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 95% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · agentscope/docs/tutorial/en/build.sh (reported line 13)May include surrounding context.
sh
# Remove temporary files (double insurance) rm -rf build/html/.doctrees rm -f build/html/.buildinfo find build/html -name "*.pickle" -delete find build/html -name "__pycache__" -delete find build/html -name "*.pyc" -delete

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 95% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · agentscope/docs/tutorial/zh_CN/build.sh (reported line 13)May include surrounding context.
sh
# Remove temporary files (double insurance) rm -rf build/html/.doctrees rm -f build/html/.buildinfo find build/html -name "*.pickle" -delete find build/html -name "__pycache__" -delete find build/html -name "*.pyc" -delete

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: 这是一个代码文件，因此应检查安全关键操作的用户披露。my_search 接收 api_key 这样的敏感凭据，并在返回文本中直接插入该密钥，属于对敏感凭据的处理且会暴露给调用方；代码中没有任何警告、掩码处理或避免展示凭据的说明。
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: These lines do more than mention the existence of execution tools: they actively register execute_python_code into the toolkit so it becomes available to the agent. For a skill whose stated purpose is helping users with AgentScope usage and examples, enabling arbitrary Python execution is a materially stronger capability than necessary.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The manifest describes this skill as a guide for using the AgentScope Python library: answering questions, providing guidance, and searching examples or API information. In contrast, the agent card exposes operational capabilities to execute Python code, run shell commands on the server, and read text files from the server, which are materially broader than documentation/help functionality.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: A documentation/help skill may reasonably search examples or explain APIs, but exposing direct Python code execution is a separate operational capability. Nothing in the stated manifest purpose requires arbitrary execution of Python snippets on behalf of the user.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill manifest describes this skill as guidance for using the AgentScope Python library, including answering questions and finding examples. This example server registers execute_python_code and execute_shell_command as tools for an agent handling user queries, which gives the skill an operational code-execution capability not justified by a documentation/help skill's stated purpose.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The handler registers execute_python_code and execute_shell_command as available tools, enabling arbitrary code and shell execution by the agent. This file contains no confirmation prompt, warning comment, or user-facing disclosure that such high-impact operations may occur.
Content: No source excerpt is available for this finding.

Known Vulnerable Dependency: vite==7.3.0 — 5 advisory(ies): CVE-2026-39365 (Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling); CVE-2026-53571 (vite: `server.fs.deny` bypass on Windows alternate paths); CVE-2026-39363 (Vite Vulnerable to Arbitrary File Read via Vite Dev Server WebSocket) +2 more

High

Category: Supply Chain
Confidence: 80% confidence
Finding: Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.
Content: No source excerpt is available for this finding.

Known Vulnerable Dependency: vite==7.3.0 — 5 advisory(ies): CVE-2026-39365 (Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling); CVE-2026-53571 (vite: `server.fs.deny` bypass on Windows alternate paths); CVE-2026-39363 (Vite Vulnerable to Arbitrary File Read via Vite Dev Server WebSocket) +2 more

High

Category: Supply Chain
Confidence: 80% confidence
Finding: Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.
Content: No source excerpt is available for this finding.

Known Vulnerable Dependency: picomatch==2.3.1 — 2 advisory(ies): CVE-2026-33672 (Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Mat); CVE-2026-33671 (Picomatch has a ReDoS vulnerability via extglob quantifiers)

High

Category: Supply Chain
Confidence: 80% confidence
Finding: Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.
Content: No source excerpt is available for this finding.