Why this verdict
- suspicious: finding skill:skills/performing-active-directory-vulnerability-assessment:skills/performing-active-directory-vulnerability-assessment/SKILL.md:131:SUPPLY
Security findings 1
Supply chain
highContextual risklow confidenceSKILL.md instructs the agent to fetch a docker-compose.yml via the short-link https://ghst.ly/getbhce and start it with docker compose up -d, executing unpinned remote content whose destination the short-link conceals.
curl -L https://ghst.ly/getbhce -o docker-compose.yml
conceal:remotevector:instruction
Counter-argument considered
Against: ghst.ly/getbhce is BloodHound CE's known quickstart, arguably instrumental to the declared BloodHound capability. For: the URL is an unpinned short-link whose destination the artifact does not fix, the fetched compose file is launched with docker compose up -d, and the claims analysis flags the domain as undeclared residue (R1), so no carve-out applies; all four gates hold and the finding stands.
Open questions 2
What the analysis could not settle from the code alone.
Static folding reports two MCP tools with non-static metadata registered at agent.py:53 and agent.py:84 ('server object srv handed to Connection(): tools may be registered out of sight'), but the full visible agent.py is a plain argparse CLI using an ldap3 Connection bind with no MCP framework imports, so whether any real MCP tool registration or metadata exists in this artifact cannot be confirmed from the shown evidence (DET:6dfe06a668551065 and DET:31f7855b3bc082e1 could not be verified).
Tool poisoning
The skill declares MCP tools whose registration metadata is computed at runtime ('not static'), and detector leads flagged the two LDAP Connection lines as registration sites; the client-facing tool metadata is not present in this batch, so TOOLPOISON via dynamic metadata can be neither confirmed nor cleared. The lines themselves are a benign LDAP bind using caller-supplied credentials.
Tool poisoning
Refuted findings 2
Candidates the review stage examined and rejected, kept for transparency.
Code execution
criticalRefutedlow confidenceSKILL.md instructs the agent to download PingCastle.zip from an unpinned releases/latest GitHub URL and run the downloaded PingCastle.exe, a download-to-execute chain whose payload contents are not fixed by the artifact (declared vendor tool, official repo, hence contextual risk).
Invoke-WebRequest -Uri
Why it was refuted
Against the finding: the download is the vendor's installer from PingCastle's official Netwrix repository, presented in a fenced 'Installation and Execution' section, and running PingCastle is the skill's declared core capability, so the vendor-installer/declared-core carve-outs apply and the harm gate fails. The URL is transparent (no concealment), no residue or contradiction was flagged for it, and the artifact itself concedes 'declared vendor tool, official repo'.
Tool poisoning
highRefutedlow confidenceThe MCP tool surface registered by scripts/agent.py cannot be statically reviewed because registration depends on an unresolved construct, so tool names, descriptions, and parameter metadata may be registered out of sight of review.
tools may be registered out of sight
Why it was refuted
The now fully served 168-line script shows Connection is ldap3's client class (imported from ldap3 at lines 11-13, aliased to None on ImportError), so lines 53 and 84 are LDAP binds, not MCP tool registrations, and the file contains no MCP server, decorator, or add_tool/register call anywhere. The detector's 'registration: unsupported' premise is a false positive: no tool metadata surface exists to be registered out of sight, and the script's actual behavior (PingCastle XML parsing plus LDAP posture checks) is exactly the declared core capability.
Coverage gaps 2
Parts of the artifact the static analysis could not fully examine.
dynamic_metadata line 53: tool (computed name) registration depends on unsupported construct (unsupported): server object srv handed to Connection(): tools may be registered out of sight
skills/performing-active-directory-vulnerability-assessment/scripts/agent.py
dynamic_metadata line 84: tool (computed name) registration depends on unsupported construct (unsupported): server object srv handed to Connection(): tools may be registered out of sight
skills/performing-active-directory-vulnerability-assessment/scripts/agent.py
