Back to skill

Security audit

Augmented Entity

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a coherent 3D chat app, but it needs review because it includes microphone speech recognition that is not clearly disclosed in the skill description.

Review before installing or using. Expect a browser 3D visualization with chat, but also expect a microphone button that can start browser speech recognition, Spanish speech output, and a remote environment asset load from a third-party host. Do not enable the microphone unless you are comfortable with the browser speech-recognition path processing your spoken input.

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (8)

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding
The reported presence of generic React/Fiber runtime internals, DOM mutation, hydration, suspense, and scheduling behavior instead of the advertised app-specific logic suggests the package contents do not match the stated purpose. While some of this may come from bundled framework code, the mismatch still undermines transparency and can hide unintended capabilities or make security review ineffective.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding
The reported presence of generic React/Fiber runtime internals, DOM mutation, hydration, suspense, and scheduling behavior instead of the advertised app-specific logic suggests the package contents do not match the stated purpose. While some of this may come from bundled framework code, the mismatch still undermines transparency and can hide unintended capabilities or make security review ineffective.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding
The reported presence of generic React/Fiber runtime internals, DOM mutation, hydration, suspense, and scheduling behavior instead of the advertised app-specific logic suggests the package contents do not match the stated purpose. While some of this may come from bundled framework code, the mismatch still undermines transparency and can hide unintended capabilities or make security review ineffective.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High
Category
YARA Match
Content
,f,d,p,v,new Ve)),s&&(y.uv1=ea.getInterpolatedAttribute(s,f,d,p,v,new Ve)),c&&(y.normal=ea.getInterpolatedAttribute(c,f,d,p,v,new K),y.normal.dot(n.direction)>0&&y.normal.multiplyScalar(-1));const _={a:f,b:d,c:p,normal:new K,materialIndex:0};ea.getNormal(xv,Av,bv,_.normal),y.face=_,y.barycoord=v}return y}class zf extends sn{constructor(e=1,t=1,n=1,i=1,s=1,c=1){super(),this.type="BoxGeometry",this.parameters={width:e,height:t,depth:n,widthSegments:i,heightSegments:s,depthSegments:c};const f=this;i=Math.floor(i),s=Math.floor(s),c=Math.floor(c);const d=[],p=[],y=[],v=[];let _=0,A=0;S("z","y","x",-1,-1,n,t,e,c,s,0),S("z","y","x",1,-1,n,t,-e,c,s,1),S("x","z","y",1,1,e,n,t,i,c,2),S("x","z","y",1,-1,e,n,-t,i,c,3),S("x","y","z",1,-1,e,t,n,i,s,4),S("x","y","z",-1,-1,e,t,-n,i,s,5),this.setIndex(d),this.setAttribute("position",new Ft(p,3)),this.setAttribute("normal",new Ft(y,3)),this.setAttribute("uv",new Ft(v,2));function S(w,T,E,B,D,I,F,O,G,H,L){const N=I/G,j=F/H,ne=I/2,ee=F/2,oe=O/2,pe=G+1,q=H
Confidence
80% confidence
Finding
YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Lp3

Medium
Category
MCP Least Privilege
Confidence
77% confidence
Finding
The skill metadata declares no tool scope or permissions, yet the surrounding analysis indicates network-capable behavior exists. In an agent setting, undeclared external communication increases risk because reviewers and users cannot accurately understand what the skill may access or transmit, enabling unexpected data egress or remote content loading.

Description-Behavior Mismatch

Medium
Confidence
96% confidence
Finding
The implementation includes conversational agent behavior, message handling, and emotional-state logic that are materially broader than the stated visualization purpose. This mismatch undermines informed consent and trust, making hidden capability abuse easier because users and reviewers may evaluate the skill under false assumptions.

Context-Inappropriate Capability

Medium
Confidence
94% confidence
Finding
The bundle contains speech recognition and speech synthesis logic in addition to the advertised 3D visualization behavior. Microphone capture and conversational processing expand the skill's data-collection surface and can surprise users, especially when those capabilities are not clearly disclosed in the skill metadata.

Natural-Language Policy Violations

Medium
Confidence
98% confidence
Finding
The code hardcodes 'es-ES' for both speech recognition and speech synthesis without presenting a user choice. While not a direct code-execution issue, it creates a privacy and UX risk because speech capture/output behavior is imposed without localization consent or accessibility controls.