Auto Building

• Outcome: Review
• Latest audit: Sep 11, 2026 · 4:03 AM UTC
• Version: 1.0.0

Overview

This skill is a coherent content-aggregation helper, but it asks users to clone and run an unpinned external Node.js project whose executable code is outside the reviewed skill package.

Install only if you trust the referenced GitHub repository and are comfortable running its Node.js code locally. Before use, pin the repository to a reviewed commit, inspect package scripts and dependencies, run with minimal credentials in a sandbox or disposable environment, and confirm that any configured data sources may be collected and republished under their terms, privacy rules, and copyright restrictions.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:9

Finding

Unpinned Remote Repository Retrieval and Dependency Execution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:9-14 and SKILL.md:34-45
Vulnerability Type: Unpinned remote payload retrieval and unsafe supply-chain execution
Risk Level: High

Vulnerable Code

SKILL.md:9-14:

yaml

install:
- id: clone
  kind: clone
  repo: hasd52636-a11y/Auto_Building_new
  label: Clone AUTO-BUILDING source code

SKILL.md:34-45:

bash

git clone https://github.com/hasd52636-a11y/Auto_Building_new
cd Auto_Building_new

bash

npm install

bash

npm run dev

The same installation workflow is repeated in README.md:20-25.

Technical Analysis

The Skill retrieves a mutable GitHub repository without pinning it to a reviewed commit hash or cryptographically verified release. It then instructs the user or agent to run npm install and npm run dev inside the retrieved repository.

The executable source, package manifest, lockfile, and transitive dependencies of that external repository are not included in this Skill package and were therefore outside the audited boundary. Consequently, the code that eventually runs can change after this Skill has been reviewed.

In addition, npm install may execute lifecycle scripts such as preinstall, install, and postinstall. These scripts execute with the privileges of the invoking user. Running npm run dev subsequently executes application-defined commands from the remotely retrieved package.

This behavior creates both a remote-payload and dependency supply-chain boundary. It exceeds the minimum privileges required for a documentation or configuration Skill because it causes unreviewed external code to be downloaded and executed locally.

Attack Path

1. An attacker compromises the referenced GitHub account or repository, gains permission to modify its default branch, or compromises one of its npm dependencies.
2. The attacker adds malicious application code, changes an npm script ...[truncated 1429 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the repository installation to a specific, reviewed full commit SHA rather than the mutable default branch.
2. Prefer packaging the reviewed source directly with the Skill so that the distributed and audited payloads are identical.
3. If remote retrieval is unavoidable, publish signed immutable releases and verify the downloaded artifact using a trusted signature or checksum.
4. Include and review a dependency lockfile, then use npm ci rather than npm install to enforce the locked dependency graph.
5. Use npm ci --ignore-scripts during initial installation where lifecycle scripts are not strictly required.
6. If lifecycle scripts are required, document each required script and review its exact implementation before permitting execution.
7. Run the retrieved application in a restricted container or sandbox with minimal filesystem access, no unnecessary credentials, limited network access, and a non-privileged user.
8. Separate source retrieval, integrity verification, dependency installation, and execution into explicit approval steps.
9. Add automated checks that reject unexpected repository revisions, dependency changes, install scripts, and unsigned release artifacts.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (6)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The README promotes automated content collection, review, and publishing from external sources but provides no cautions about legal, operational, or security risks such as violating target site terms, ingesting malicious content, or republishing untrusted data. In this skill context, the danger is elevated because the described workflow is explicitly designed to fetch from third-party sources and then publish content, which can amplify abuse or contamination if safeguards are absent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill explicitly promotes automated collection from external data sources but does not warn users about legality, terms-of-service compliance, privacy, rate limiting, or the need to review collected content before use. In a scraping/aggregation skill, that omission materially increases the chance of unsafe or non-compliant collection and downstream publication behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The manifest description and the full instructional content are presented exclusively in Chinese, and the skill does not state that it is region-specific or provide any user language choice. Under the policy rule, forcing a specific language without opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

These operational steps instruct users to add rules, execute collection, and publish via the workflow with no explicit warning about scraping behavior, source permissions, copyright/privacy review, or verification before publication. Because the skill is specifically designed to automate collection and display of third-party content, the missing warnings make misuse more likely and the context makes the finding more significant.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The README presents its core functional description in Chinese and does not indicate that users may choose another language or that the skill is intentionally restricted to a Chinese-language audience. This can violate language/locale policy when a skill implicitly forces a language without user opt-in or documented justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The package description is written only in Chinese, which indicates a language-specific presentation without any visible opt-in, alternative locale, or justification that the skill is intended solely for a Chinese-speaking region. Under the policy criteria, forcing a specific language without user choice can be a natural-language policy violation.

Content

No source excerpt is available for this finding.