Coda Packs

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 3:24 PM UTC
• Version: 1.0.0

Overview

This skill is a coherent Coda Packs management helper with expected API-token use and Pack mutation actions, but users should be careful with unpinned npm tooling, command-line tokens, and forced deletion.

Install only if you are comfortable giving the tool a Coda API token with Pack-management permissions. Prefer CODA_API_TOKEN over --token, avoid --force except in deliberate automation, double-check Pack IDs before deletion, and pin or locally lock @codahq/packs-sdk before running the npm/npx development commands.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:91

Finding

Unpinned Coda Pack SDK Installation and Execution

Content

View full analysis

Remediation

View remediation

build ``` 2. Prefer a project-local development dependency over global installation: ```bash npm install --save-dev --save-exact @codahq/packs-sdk@ ``` 3. Commit and enforce a lockfile, and use `npm ci` for reproducible installation. 4. Verify package provenance, registry source, and integrity before execution. 5. Review transitive dependencies and npm lifecycle scripts for the pinned release. 6. Run dependency tooling as an unprivileged user and never recommend elevated installation. 7. Update every SDK command in `SKILL.md` to reference the same audited version. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/coda_packs_cli.py:366

Finding

Coda API Token Can Be Exposed Through Command-Line Arguments

Content

View full analysis

` can be recorded in shell history, process listings, system audit telemetry, terminal logs, CI/CD logs, command wrappers, or diagnostic reports. The client subsequently uses this token as a Bearer credential for Coda API requests. Sending the credential to the fixed HTTPS endpoint `https://coda.io/apis/v1` is necessary for the declared Pack-management functionality and was not found to be unrelated exfiltration. The vulnerability is the additional argv-based credential input mechanism, not the authenticated HTTPS request itself. ### Attack Path 1. A user invokes the CLI with a command such as: ```bash python scripts/coda_packs_cli.py --token SECRET packs list ``` 2. The complete command is retained in shell history, captured by an automation log, or exposed through process metadata while the command is running. 3. A local user, log reader, monitoring integration, or compromised process obtains the token. 4. The attacker submits authenticated requests to t ...[truncated 636 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (24)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The skill instructs users to run npx @codahq/packs-sdk without pinning an exact version, which allows whatever package version is current at execution time to be fetched and executed. If the upstream package is compromised, a malicious release is published, or behavior changes unexpectedly, this can lead to arbitrary code execution on the user's machine.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

This command uses npx to execute @codahq/packs-sdk without an exact version pin. Unpinned package execution creates a supply-chain risk because the resolved code may change over time or be replaced by a malicious upstream release.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The documented npx invocation pulls and runs a package without version pinning. That exposes users to upstream compromise and non-deterministic behavior, especially risky for tooling that is granted access to local code and credentials.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The install instruction npm install -g @codahq/packs-sdk does not pin a specific version, so users will receive the latest available package at install time. This increases supply-chain exposure and makes builds and behavior non-reproducible.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

Running npx @codahq/packs-sdk build without version pinning executes code resolved at runtime from the registry. A malicious or altered upstream release could execute arbitrary code and affect local source, secrets, or build outputs.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

This unpinned npx command carries the same supply-chain risk as other runtime package executions. Because the command uploads or interacts with Pack tooling, compromise could impact both the local environment and remote resources accessible via credentials.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The release command executes an unpinned package from the npm ecosystem, which is a classic supply-chain risk. The danger is elevated by the fact that release workflows often run in privileged developer or CI environments with access to source code and tokens.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Documenting a --force flag to skip delete confirmation weakens an important guardrail around an irreversible operation. In an agent-driven or scripted context, this can enable accidental or unauthorized destructive actions with less user friction, especially if a pack name/ID is resolved incorrectly.

Content

Scanner excerpt · SKILL.md (reported line 132)May include surrounding context.

Delete Pack (requires confirmation)

python scripts/coda_packs_cli.py packs delete my-pack-id

Or skip confirmation: --force

text

### Pack ID Resolution

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 155)May include surrounding context.

md

|-----------|------|--------------|
| **Delete Pack** | Irreversible | "Delete Pack 'X'? This cannot be undone." |

### No Confirmation Required

- **Create Pack**: Safe, reversible
- **List/Get Packs**: Read-only

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The initialization command references npx @codahq/packs-sdk without a fixed version, allowing arbitrary future code changes to be pulled into the environment. This is a reproducibility and supply-chain integrity issue rather than an overtly malicious instruction.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

This second command on the same line also runs an unpinned package from npm, creating the same supply-chain exposure. Combining multiple unpinned executions in one shell line increases the blast radius if the package is malicious or unexpectedly changed.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · scripts/coda_packs_cli.py (reported line 276)May include surrounding context.

python

print_json(pack)
    
    def create(self, args):
        """Create new Pack (no confirmation required)."""
        payload = {
            "name": args.name,
            "description": args.description or ""

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · scripts/coda_packs_cli.py (reported line 383)May include surrounding context.

python

print_json(pack)
    
    def create(self, args):
        """Create new Pack (no confirmation required)."""
        payload = {
            "name": args.name,
            "description": args.description or ""

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · scripts/coda_packs_cli.py (reported line 367)May include surrounding context.

python

"""
    )
    parser.add_argument("--token", help="Coda API token (or set CODA_API_TOKEN env var)")
    parser.add_argument("--force", action="store_true", help="Skip confirmations (use with caution)")
    
    subparsers = parser.add_subparsers(dest="command_group")

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The CLI help text says --readme is a 'Path to README file', which implies the program will open that file and use its contents. In create(), however, args.readme is copied directly into the API payload at L281-L282 with no file read, so the implementation contradicts the documented behavior and may cause users to transmit an unintended filesystem path string to the remote API.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

This code reads the sensitive CODA_API_TOKEN from the environment and attaches it as a Bearer token to all outbound API requests. Although the module docstring mentions setting the token, there is no user-facing warning at the point of execution that credentials will be sent over the network to Coda.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.