Security audit

Multi-Agent Safe-Cooperation (Single Device)

Security checks for vulnerabilities and agentic risk

Overview

This skill needs careful review because it coordinates agents around local secrets and script execution while teaching broad secret retrieval, plaintext result files, and persistent user-history updates without strong controls.

Install only if you trust the MGC package and are prepared to run it with tight local controls. Pin and isolate the dependency, approve each script save and run, allow only specific secrets per script, treat ~/mgc_outputs as sensitive, clean up result files, and review or disable automatic updates to the best-practice document before using this with real credentials or customer data.

A.I.G

Vulnerability Patterns

Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection

Findings (5)

T05 · Unauthorized Access and Privilege Escalation

Error

Location: prompts/script_agent.md:99
Finding: Generated Scripts Can Retrieve Arbitrary Plaintext Secrets Using a Reusable MGC Token
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: prompts/script_agent.md:14
Finding: Sensitive Script Results Are Written to Unprotected Plaintext Files
Content: View full analysis
Remediation: View remediation

T02 · Agent Memory Poisoning

Warning

Location: prompts/master_agent.md:256
Finding: Automatic Cross-Task State Updates Enable Memory Poisoning and Uncontrolled User Profiling
Content: View full analysis
Records user habits, updated after each task | Preference | Content | Updated | |------------|---------|---------| | (none yet) | - | - | added after task completion | ``` ```markdown ## Collaboration Log and User Feedback > Recorded after each task completion | Date | Task | User Feedback | Improvement | |------|------|---------------|-------------| | (none yet) | - | - | added after task completion | ``` ### Technical Analysis The Master Agent is required to read and modify an instruction-adjacent Markdown file across tasks. The persistent state includes user habits, task history, feedback, error handling, script references, and suggested improvements. No schema validation, provenance tracking, sanitization, trust separation, consent mechanism, retention period, or rule prohibiting stored instructions is specified. Because this state is read before future task decomposition, attacker-controlled task or feedback text can potentially be transformed into persistent content that influences later sessions. Storing user habits and task history automatically also creates a privacy risk independent of instruction poisoning. Users are not ...[truncated 1121 chars]
Remediation: View remediation

T07 · Tool Hijacking and Spoofing

Warning

Location: prompts/executor_agent.md:134
Finding: Opaque Scripts Can Be Selected and Executed Through Fuzzy Metadata Matching
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: README.md:35
Finding: Unpinned Third-Party Package Is Installed and Immediately Executed
Content: View full analysis
=1.4.9 ``` ### Technical Analysis The installation process permits the package manager to select a mutable current or future release of `mgc-blackbox`. No exact version, package hash, lockfile, signature verification, or reproducible artifact reference is provided. The installed package is immediately launched as the `mgc` service and may also be configured as an MCP server. This grants package code local execution in an environment designed to host scripts, API keys, database credentials, and an authentication token. The repository does not establish that the package is currently malicious. The vulnerability is the unsafe supply-chain trust model: a compromised, replaced, or unexpectedly changed future release could execute with substantial local access. ### Attack Path 1. A package release is compromised, maliciously transferred, or changed incompatibly after this Skill is reviewed. 2. A user follows `pip install mgc-blackbox` or installs a version satisfying `>=1.4.9`. 3. The package manager retrieves the changed release. 4. The user runs `mgc` or configures it as an MCP server. 5. The unreviewed package code executes locally. 6. It can attempt to access MGC data, local files, Agent communications, or credentials available to the process. ### Impact Assessment A compromised dependency can obtain the privileges of the user running MGC. Potential reach includes local files, MGC-hosted resources, the MGC token, Agent tool traffic, and network access allowed to the process. Actual impact depends on operating-system isolation and runtime permissions. The audit found no ...[truncated 142 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (18)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The README states that the Master Agent will automatically decompose tasks and coordinate sub-agents to complete them, but it does not clearly warn that those agents may trigger script execution against the local MGC environment or stored sensitive resources. In a skill specifically designed for multi-agent orchestration and script execution, this omission can cause users to enable powerful automation without understanding that actions may have side effects on the local system, browser, or protected assets.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill identifier ends with _en, indicating an English-specific variant, but the document does not provide any user opt-in, language selection mechanism, or justification for enforcing English. Under the policy rule, forcing a specific language without user choice is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The manifest sets "language": "en", which indicates a fixed language/locale choice. Under the policy rules, forcing a specific language without user opt-in or a documented region-specific justification is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The workflow explicitly instructs agents to save execution results to local files for later reading, but it provides no warning that these files may contain sensitive data and will persist on disk. That omission increases the chance that operators and downstream agents treat the files as harmless, leading to unintended retention, discovery, or leakage.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The example code writes arbitrary data to a predictable local output directory and prints the path for later access, normalizing persistence of potentially sensitive data without any surrounding notice about confidentiality, retention, or cleanup. In a skill centered on 'safe cooperation,' this can mislead users into believing the pattern is secure by default when it is not.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill markets the workflow as 'zero-exposure' for sensitive resources, yet its own process requires agents to read result files from disk, which are plaintext artifacts outside the sealed execution boundary. This creates a confidentiality gap because sensitive or insufficiently redacted outputs can persist locally and be accessed by other agents, users, or processes on the same device.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The document states customer data is never exposed, but the marketing workflow has the Executor Agent filter target users before the sealed notification script runs, implying access to customer-identifying data outside the protected boundary. This undermines the stated security model and can expose customer data to broader handling, logging, or misuse.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The prompt directs the agent to modify cooperation_best_practice.md and store user-related preferences/logs after task completion, but it does not require explicit user notice or consent before writing persistent state. This creates a privacy and integrity risk because user interaction data may be retained unexpectedly and future agent behavior can be influenced by silently accumulated state.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill explicitly tells the agent to capture user preferences, common errors, and collaboration logs in a shared best-practice document. Retaining user-specific interaction data in shared memory without clear consent, retention limits, or access controls can expose behavioral data across tasks or users and create unauthorized profiling or leakage.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The prompt instructs use of mgc_save to persist script bodies in managed storage without requiring confirmation that code will be stored for later reuse. Persistent storage of generated scripts can retain sensitive logic, secrets, or unsafe code paths beyond the current session, increasing the blast radius of prompt injection or operator mistakes.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · prompts/script_agent.md (reported line 3)May include surrounding context.
md
# Script Agent Prompt Template You are the Script Agent. You write business scripts per Master Agent's instructions and store them securely in MGC. ---

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill markets itself as enabling 'zero-exposure security collaboration' while simultaneously documenting local file output and direct secret retrieval from the local environment. This mismatch is dangerous because it can cause users and downstream agents to overtrust the workflow and use it for sensitive tasks under incorrect security assumptions.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The prompt explicitly instructs scripts to persist execution results to local files outside the sealed MGC path. In a skill claiming 'zero-exposure' handling for sensitive resources, this creates a clear data exposure path because outputs may contain analysis results, file paths, or sensitive derived data that remain on disk and are accessible beyond the protected workflow.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The prompt teaches generated scripts how to read a local token file and use it to retrieve secrets over an API, giving the Script Agent a reusable mechanism for credential access beyond merely authoring scripts. This materially expands the capability surface: any generated script can be adapted to fetch secrets locally, increasing the risk of credential misuse or unintended secret exposure.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The credential retrieval instructions describe reading a local auth token and transmitting requests to a local HTTP endpoint without any prominent warning to users that scripts will access local authentication state and retrieve credentials. Lack of transparent disclosure and consent increases the chance of unsafe use and weakens operator ability to assess data-handling risk.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 70% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · prompts/script_agent.md (reported line 139)May include surrounding context.
md
"action": "run" } response = requests.post(url, json=data, headers=headers) if response.status_code == 200: result = response.json() if isinstance(result, str):

External Transmission

Medium

Category: Data Exfiltration
Confidence: 70% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · prompts/script_agent.md (reported line 214)May include surrounding context.
md
"action": "run" } response = requests.post(url, json=data, headers=headers) if response.status_code == 200: result = response.json() if isinstance(result, str):

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The tool reference advertises capabilities to execute scripts and open the WebUI, but it provides no adjacent warning about execution risk, privacy implications, or the possibility of triggering sensitive workflows. Because this skill centers on delegating actions among multiple agents, presenting these tools as simple utilities without safety caveats makes unsafe use more likely and lowers the barrier to accidental misuse.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.