atxp
Verdict safe, but 3 findings (3 medium), mainly data exfiltration, unauthorized tool use. Most recent scan 2026-02-05.
The ATXP skill provides legitimate functionality for accessing external API services (web search, AI media generation, email) but presents MEDIUM security risks primarily around credential management and external tool execution. The skill relies on npx to execute commands from an external npm package, creating supply chain risk if that package is compromised. Credential handling via environment variable sourcing could expose sensitive tokens. The email send functionality could be abused for data exfiltration without proper safeguards. Missing metadata fields reduce transparency. The skill does not contain direct prompt injection attempts or obvious malicious code, but the external dependencies and credential exposure patterns warrant careful review before deployment.
Scanner's overall assessment (LLM analyzer)
Second scanner: NVIDIA SkillSpector
Independent static run, no language model, over the same files as the Cisco scan above. How the two scanners compare across the whole corpus: Two scanners, one corpus.
What this skill does
Access ATXP paid API tools for web search, AI image generation, music creation, video generation, X/Twitter search, and email. Use when users need real-time web search, AI-generated media (images, music, video), X/Twitter search, or to send/receive emails. Requires authentication via `npx atxp login`.
- Package
- 1 file, 2.8 KB
- SKILL.md
- 367 words, 12+ sections
- Code
- None. Instructions only.
SKILL.md covers: ATXP Tools · Authentication · Check if authenticated · If not set, login: · Commands · Email · Check Inbox · Read Message · Send Email · PaaS Tools · Usage · Programmatic Access
Findings
MEDIUM Credential Exposure via Environment Variable Sourcing Data Exfiltrationllm
The skill instructs the agent to execute 'source ~/.atxp/config' which loads environment variables from a user configuration file. This pattern can expose credentials if the config file is compromised or if the skill is used in a shared environment. The ATXP_CONNECTION credential is then stored in the environment and could be accessed by other processes or logged.
SKILL.md
```bash
# If not set, login:
npx atxp login
source ~/.atxp/config
```MEDIUM Unrestricted External Tool Execution via npx Unauthorized Tool Usellm
The skill executes arbitrary npx commands to interact with external ATXP API services without any validation or sandboxing. The npx command can download and execute code from npm registries, creating a supply chain risk. If the 'atxp' package is compromised or typosquatted, malicious code could be executed on the user's system.
SKILL.md
```bash
npx atxp search <query>
npx atxp image <prompt>
npx atxp music <prompt>
npx atxp video <prompt>
npx atxp x <query>
npx atxp email inbox
npx atxp email send --to <email> --subject <subject> --body <body>
```MEDIUM Potential Data Exfiltration via Email Send Functionality Data Exfiltrationllm
The skill provides email sending capabilities that could be abused for data exfiltration. An attacker could use prompt injection to instruct the agent to send sensitive data from the user's system to an external email address. The skill does not implement any restrictions on email recipients or content validation.
SKILL.md
```bash
npx atxp email send --to <email> --subject <subject> --body <body>
```
No validation of recipient addresses or content filtering is mentioned.What is in the package
| File | Kind | Size |
|---|---|---|
SKILL.md | doc | 2.8 KB |
External hosts referenced
search.mcp.atxp.ai
Hostnames that appear in the skill's files. Referencing a host is not a finding; compare against the findings above and the skill's stated purpose.
Package contents recorded 2026-10-22 at commit 3208b5e5d42e. The scan above ran against the version current at scan time; the two can differ if the skill has since been updated.
What we checked
- Static analyzer. Pattern rules over SKILL.md and bundled files: known-bad commands, exfiltration URLs, secrets, obfuscation.
- Behavioral analyzer. Checks what the skill asks the agent to do against what its description claims it does.
- Llm analyzer. A language model reads the skill and reports intent-level issues the rules cannot express.
- Trigger analyzer. Looks for instructions that fire on conditions the user did not ask for.
- Meta analyzer. A second model pass that validates, deduplicates and re-scores the other analyzers' findings.
What we did not check
- Runtime behaviour. The skill was not executed; findings come from reading its files.
- Anything fetched at install or run time, including remote scripts, package dependencies, and URLs the skill tells the agent to open.
- Content the analyzers cannot read: images, binaries, and some non-English text.
- Known scanner bypass classes. See the methodology and limitations page.
Sources
- Repository: https://github.com/atxp/dev-cli
- Raw scan result: atxp-scan.json
- Badge for your README:
- Request a re-scan