OpenTangl

• Outcome: Review
• Latest audit: Sep 10, 2026 · 11:39 PM UTC
• Version: 0.1.10

Overview

The skill is coherent for setting up an autonomous development tool, but it combines high-impact autonomous repo changes with mutable third-party install and runtime commands.

Review before installing. Use a limited GitHub token or account, test on non-critical repositories first, pin the OpenTangl repository to a reviewed commit, prefer lockfile-based installs, and confirm whether autopilot can merge without a human approval step before granting it access to important projects.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:20

Finding

Unpinned Third-Party Repository and Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 20-24
Vulnerability Type: Unverified third-party software and dependency installation
Risk Level: Medium

bash

git clone https://github.com/8co/opentangl.git
cd opentangl
npm install

Technical Analysis

The installation instructions clone the current state of a remote repository without pinning a reviewed commit or release tag. They then invoke npm install without requiring integrity verification or disabling lifecycle scripts.

Because the repository and its dependency graph can change after this Skill has been reviewed, users may execute content that was not included in the audit. In particular, npm install can execute package lifecycle scripts such as preinstall, install, and postinstall with the privileges of the current user. A compromise of the upstream repository, a dependency, or the package lock data could therefore turn these instructions into a code-execution path.

The repository URL is consistent with the homepage declared by the Skill, and the audited file does not itself contain an intentionally malicious payload. The risk arises from trusting mutable external content and executing its dependency installation process without pinning or verification.

Attack Path

1. An attacker compromises the upstream OpenTangl repository, an account authorized to modify it, or a dependency referenced by the project.
2. The attacker adds malicious installation code, such as an npm lifecycle script, or alters dependency resolution to retrieve a malicious package.
3. A user follows the Skill instructions and clones the unpinned default branch.
4. The user runs npm install.
5. npm resolves the attacker-controlled content and executes an applicable lifecycle script with the user's local privileges.
6. The malicious code can access resources available to that user before the autonomous development workflow begins.

Impact Assess

...[truncated 799 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin installation to a reviewed commit hash or signed release rather than cloning and using the mutable default branch.
2. Publish and document the expected commit identifier, release signature, or checksum so users can verify the downloaded source before execution.
3. Require a committed, reviewed npm lockfile and use npm ci instead of npm install to enforce reproducible dependency resolution.
4. Perform the initial dependency installation with npm ci --ignore-scripts where feasible.
5. If lifecycle scripts are required, identify them explicitly, audit their source, and run only the necessary scripts after verification.
6. Recommend installation in an isolated, least-privileged environment without production credentials or unrelated repositories.
7. Add dependency and provenance controls, such as automated vulnerability scanning, lockfile review, signed releases, and verification of package registry sources.
8. Re-audit the pinned release before updating the documented commit or version.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 87% confidence

Finding

The skill instructs use of npx create-next-app@latest, which fetches and executes a package version determined at runtime rather than a pinned, reviewed version. In a high-automation development skill, this creates a supply-chain risk and reproducibility problem: future runs may execute changed code or a compromised release without user awareness.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The skill directs the agent to create projects.yaml in the OpenTangl root without a clear user-facing warning immediately preceding the filesystem write. In an agentic context, silent file creation can surprise users, alter repository state, and set up subsequent autonomous actions that the user may not fully understand.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This section instructs creating or updating multiple local files, including docs/environments/.../product-vision.md and potentially .gitignore, without a strong write-consent prompt at each modification point. In a skill designed for autonomous development and multi-repo orchestration, unannounced file edits can compound into unexpected changes that influence later automated code generation and merges.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The skill instructs initialization of tasks/queue.yaml via shell commands that create directories and files, but does not clearly warn the user that these writes will occur as part of the step. In a workflow that later drives autonomous execution, even small state-initialization writes matter because they can trigger or shape subsequent automated behavior.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

The skill tells the user to launch autopilot via npx tsx src/cli.ts ..., which resolves and may execute an unpinned package at runtime. Because this command initiates autonomous code changes, PR creation, and merges, any compromise or unexpected version drift in tsx would run in a highly privileged workflow and could affect multiple repositories.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

This is the same unpinned npx tsx issue in the multi-project autopilot path, with even broader blast radius because it can orchestrate changes across multiple repos. Executing an unpinned runtime dependency in an autonomous merge workflow materially increases supply-chain risk and can lead to unauthorized code execution or repo modification.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

At L140 the document explicitly says to 'Do not accept or handle API keys directly' and to let the user create the .env file themselves. Immediately after, L142 instructs the agent to read and, if needed, modify .gitignore, which is an active filesystem change during the secret-handling step rather than a purely hands-off instruction flow. This is a mild intent divergence in the step's documentation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.