Pre Flight

• Outcome: Review
• Latest audit: Sep 11, 2026 · 3:19 PM UTC
• Version: 1.0.6

Overview

This skill is a disclosed cloud guardrail, but it asks agents to send detailed plans, proposed actions, policy variables, and payment-related checks to external services with weak minimization guidance.

Install only if you are comfortable having ICME receive the action descriptions, policy identifiers, plans, and proof/payment metadata needed for checks. Avoid sending secrets, private keys, credentials, raw transcripts, private message bodies, or regulated personal data; prefer structured/minimized action descriptions and pin or review any payment helper such as agentcash before use.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:26

Finding

Sensitive Operational Data Is Transmitted to a Third-Party API Without Mandatory Minimization or Consent

Content

View full analysis

"}' ``` ``` Lines 74–90 direct the Agent to submit proposed actions to the service before every action: ```markdown Screen an action against your policy to see if it touches any policy variables. No credits charged. Use this to decide whether the action needs a full `checkIt` call. ### When to use Call checkRelevance before every action. It tells you whether the action is related to your policy at all. If it isn't, skip `checkIt` and proceed. If it is, run the full check. ### How to use POST to `/v1/checkRelevance` with your `policy_id` and the proposed action: ```bash curl -s -X POST https://api.icme.io/v1/checkRelevance \ -H "Content-Type: application/json" \ -H "X-API-Key: $ICME_API_KEY" \ -d "{ \"policy_id\": \"$ICME_POLICY_ID\", \"action\": \"\" }" ``` ``` Lines 149–168 request detailed action information, including potentially sensitiv ...[truncated 5945 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (42)

Self-Modification

High

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · README.md (reported line 149)May include surrounding context.

md

## Why this matters for Capability Evolver users

Capability Evolver's own docs say `EVOLVE_ALLOW_SELF_MODIFY=true` is "catastrophic." Their recommended safeguard is a boolean flag and a `--review` mode. Those are config settings — an agent with file system access can change config settings.

ICME's policy lives on an external server your agent cannot modify. The rules are compiled into formal logic once by a human. Every proposed action or evolution is checked against that logic by PreFlight's solver. The agent receives SAT or UNSAT. There is nothing to override, no flag to flip, no prompt to inject around.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The README repeatedly encourages sending agent reasoning, actions, policy data, and proof metadata to external ICME endpoints but does not provide a clear privacy or data-transfer warning near those examples. In an agent setting, those payloads may contain sensitive business logic, credentials-adjacent context, transaction details, or user data, increasing the risk of unintended exfiltration to a third party.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 89% confidence

Finding

The checkLogic example explicitly sends free-form agent reasoning to https://api.icme.io/v1/checkLogic. Reasoning traces can contain sensitive internal context, plans, or embedded secrets, so transmitting them to an external service introduces confidentiality risk even if the service is legitimate.

Content

Scanner excerpt · README.md (reported line 28)May include surrounding context.

Catches logical contradictions in your agent's reasoning before it acts. No API key required.

bash

curl -s -X POST https://api.icme.io/v1/checkLogic \
  -H "Content-Type: application/json" \
  -d '{"reasoning": "The budget is $10,000. I will spend $6,000 on marketing and $7,000 on engineering."}'

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 89% confidence

Finding

The checkLogic example explicitly sends free-form agent reasoning to https://api.icme.io/v1/checkLogic. Reasoning traces can contain sensitive internal context, plans, or embedded secrets, so transmitting them to an external service introduces confidentiality risk even if the service is legitimate.

Content

Scanner excerpt · README.md (reported line 28)May include surrounding context.

Catches logical contradictions in your agent's reasoning before it acts. No API key required.

bash

curl -s -X POST https://api.icme.io/v1/checkLogic \
  -H "Content-Type: application/json" \
  -d '{"reasoning": "The budget is $10,000. I will spend $6,000 on marketing and $7,000 on engineering."}'

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 90% confidence

Finding

The checkRelevance example sends policy identifiers and action descriptions to an external service. Those action descriptions may reveal planned operations, internal system details, or sensitive workflow context, creating a real data exposure risk in the skill's intended use case.

Content

Scanner excerpt · README.md (reported line 42)May include surrounding context.

Screens an action against your policy to see if it touches any policy variables. No credits charged. Use this to decide whether an action needs a full checkIt call.

bash

curl -s -X POST https://api.icme.io/v1/checkRelevance \
  -H "Content-Type: application/json" \
  -H "X-API-Key: $ICME_API_KEY" \
  -d '{

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 90% confidence

Finding

The checkIt example sends policy-linked action content to an external API to decide whether an operation is allowed. In practice, these payloads can include sensitive transaction details, email contents, file-operation descriptions, or other confidential intent data, so this is a meaningful external transmission risk.

Content

Scanner excerpt · README.md (reported line 60)May include surrounding context.

The full guardrail. Compile your rules once, then check every action against them. Requires an API key and credits.

bash

curl -s -N -X POST https://api.icme.io/v1/checkIt \
  -H 'Content-Type: application/json' \
  -H "X-API-Key: $ICME_API_KEY" \
  -d '{

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 92% confidence

Finding

The checkItPaid flow sends policy/action data to an external API and additionally routes the request through a payment-capable toolchain (agentcash/x402), increasing both data-exposure and supply-chain surface. For autonomous agents with wallets, this can also create financial-risk coupling if the payment helper or flow is compromised.

Content

Scanner excerpt · README.md (reported line 78)May include surrounding context.

Same as checkIt but paid per-call via x402 USDC on Base. No API key, no credits, no account required. The x402 middleware handles payment automatically.

bash

npx agentcash fetch "https://api.icme.io/v1/checkItPaid" \
  -m POST \
  -b '{"policy_id":"YOUR_POLICY_ID","action":"Send 1000 USDC to an unknown wallet. Therefore this transfer is permitted."}'

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The README instructs users to invoke an unpinned package via npx agentcash, which fetches and executes whatever version is current at install time. This creates a supply-chain risk: a compromised or malicious upstream release could execute arbitrary code on the user's machine or in the agent environment.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 19)May include surrounding context.

md

Your rules get translated into math and checked by a solver that gives you a definitive yes or no. No confidence scores, no guessing.

**Base URL:** `https://api.icme.io/v1`
**Authentication:** `X-API-Key: $ICME_API_KEY` (for authenticated endpoints)

---

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 59)May include surrounding context.

md

Your rules get translated into math and checked by a solver that gives you a definitive yes or no. No confidence scores, no guessing.

**Base URL:** `https://api.icme.io/v1`
**Authentication:** `X-API-Key: $ICME_API_KEY` (for authenticated endpoints)

---

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 206)May include surrounding context.

md

Your rules get translated into math and checked by a solver that gives you a definitive yes or no. No confidence scores, no guessing.

**Base URL:** `https://api.icme.io/v1`
**Authentication:** `X-API-Key: $ICME_API_KEY` (for authenticated endpoints)

---

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 283)May include surrounding context.

md

Your rules get translated into math and checked by a solver that gives you a definitive yes or no. No confidence scores, no guessing.

**Base URL:** `https://api.icme.io/v1`
**Authentication:** `X-API-Key: $ICME_API_KEY` (for authenticated endpoints)

---

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 293)May include surrounding context.

md

Your rules get translated into math and checked by a solver that gives you a definitive yes or no. No confidence scores, no guessing.

**Base URL:** `https://api.icme.io/v1`
**Authentication:** `X-API-Key: $ICME_API_KEY` (for authenticated endpoints)

---

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 301)May include surrounding context.

md

Your rules get translated into math and checked by a solver that gives you a definitive yes or no. No confidence scores, no guessing.

**Base URL:** `https://api.icme.io/v1`
**Authentication:** `X-API-Key: $ICME_API_KEY` (for authenticated endpoints)

---

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 449)May include surrounding context.

md

Your rules get translated into math and checked by a solver that gives you a definitive yes or no. No confidence scores, no guessing.

**Base URL:** `https://api.icme.io/v1`
**Authentication:** `X-API-Key: $ICME_API_KEY` (for authenticated endpoints)

---

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 454)May include surrounding context.

md

Your rules get translated into math and checked by a solver that gives you a definitive yes or no. No confidence scores, no guessing.

**Base URL:** `https://api.icme.io/v1`
**Authentication:** `X-API-Key: $ICME_API_KEY` (for authenticated endpoints)

---

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 460)May include surrounding context.

md

Your rules get translated into math and checked by a solver that gives you a definitive yes or no. No confidence scores, no guessing.

**Base URL:** `https://api.icme.io/v1`
**Authentication:** `X-API-Key: $ICME_API_KEY` (for authenticated endpoints)

---

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 472)May include surrounding context.

md

Your rules get translated into math and checked by a solver that gives you a definitive yes or no. No confidence scores, no guessing.

**Base URL:** `https://api.icme.io/v1`
**Authentication:** `X-API-Key: $ICME_API_KEY` (for authenticated endpoints)

---

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 486)May include surrounding context.

md

Your rules get translated into math and checked by a solver that gives you a definitive yes or no. No confidence scores, no guessing.

**Base URL:** `https://api.icme.io/v1`
**Authentication:** `X-API-Key: $ICME_API_KEY` (for authenticated endpoints)

---

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 509)May include surrounding context.

md

Your rules get translated into math and checked by a solver that gives you a definitive yes or no. No confidence scores, no guessing.

**Base URL:** `https://api.icme.io/v1`
**Authentication:** `X-API-Key: $ICME_API_KEY` (for authenticated endpoints)

---

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 96% confidence

Finding

The documented checkLogic call sends reasoning text to a third-party endpoint. In this skill's context, that creates meaningful confidentiality risk because users may assume a safety tool is local while it actually externalizes internal planning content.

Content

Scanner excerpt · SKILL.md (reported line 40)May include surrounding context.

POST to /v1/checkLogic with the reasoning as a single string:

bash

curl -s -X POST https://api.icme.io/v1/checkLogic \
  -H "Content-Type: application/json" \
  -d '{"reasoning": "<the reasoning, plan, or statements to check>"}'

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 96% confidence

Finding

The documented checkLogic call sends reasoning text to a third-party endpoint. In this skill's context, that creates meaningful confidentiality risk because users may assume a safety tool is local while it actually externalizes internal planning content.

Content

Scanner excerpt · SKILL.md (reported line 40)May include surrounding context.

POST to /v1/checkLogic with the reasoning as a single string:

bash

curl -s -X POST https://api.icme.io/v1/checkLogic \
  -H "Content-Type: application/json" \
  -d '{"reasoning": "<the reasoning, plan, or statements to check>"}'

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 59)May include surrounding context.

Example

bash

curl -s -X POST https://api.icme.io/v1/checkLogic \
  -H "Content-Type: application/json" \
  -d '{"reasoning": "The budget is $10,000. I will spend $6,000 on marketing and $7,000 on engineering."}'

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 94% confidence

Finding

The skill instructs sending proposed actions and policy identifiers to an external API for screening. Because those action descriptions may encode sensitive user operations or internal policy structure, this is a real external-data-exposure risk.

Content

Scanner excerpt · SKILL.md (reported line 85)May include surrounding context.

POST to /v1/checkRelevance with your policy_id and the proposed action:

bash

curl -s -X POST https://api.icme.io/v1/checkRelevance \
  -H "Content-Type: application/json" \
  -H "X-API-Key: $ICME_API_KEY" \
  -d "{

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 95% confidence

Finding

The example demonstrates transmitting a concrete outbound action description to the external service. This reinforces a real risk of leaking operational details, destinations, and business context to a third party.

Content

Scanner excerpt · SKILL.md (reported line 110)May include surrounding context.

An action that touches the policy:

bash

curl -s -X POST https://api.icme.io/v1/checkRelevance \
  -H "Content-Type: application/json" \
  -H "X-API-Key: $ICME_API_KEY" \
  -d "{

Static analysis

No suspicious patterns detected.