daily-tips-omni

• Outcome: Review
• Latest audit: Sep 16, 2026 · 11:12 AM UTC
• Version: 1.0.2

Overview

The skill mostly provides local daily tips, but its unpinned installer and dormant shell-executed Reddit helper need review before installation.

Review this before installing in a sensitive environment. Prefer a pinned installer or verified artifact, and treat the saved/skipped-topic files as local preference history. The publisher should remove or harden the unused Reddit shell helper and document data storage and network behavior clearly.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:164

Finding

Unpinned Third-Party Installer Creates Supply-Chain Exposure

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:164 and README.md:19
Vulnerability Type: Unpinned third-party installer and mutable upstream source
Risk Level: Medium

Vulnerable Code

SKILL.md:164:

bash

npx skills add adelpro/daily-tips-omni

README.md:19:

bash

npx skills add adelpro/daily-tips-omni

Technical Analysis

The recommended installation command invokes the npm-delivered skills CLI without specifying an exact package version. It also identifies the Skill through a mutable repository reference rather than a reviewed commit SHA or immutable release artifact.

Consequently, the code executed or installed by this command can differ from the version covered by this audit. Although no malicious dependency was identified in the audited files, the installation process relies on the continuing integrity of the npm package, its maintainer account, the package registry, and the upstream Skill repository.

Attack Path

1. An attacker compromises the npm package, publisher account, registry resolution path, or mutable upstream repository.
2. The attacker publishes a malicious CLI version or replaces the content resolved by adelpro/daily-tips-omni.
3. A user follows the documented installation command.
4. npx downloads and runs the currently resolved CLI package.
5. The compromised component executes with the installing user's privileges or installs modified Skill files that execute later.

Impact Assessment

Exploitation could provide code execution with the privileges of the user running the installer. Depending on that user's environment, malicious installer code could read user-accessible files and credentials, modify the Agent workspace, install additional components, or establish persistence. The audited project itself does not demonstrate such behavior; the risk arises from the unpinned installation chain.

Remediation

View remediation

Remediation Suggestions

• Pin the skills CLI to an exact reviewed version, for example by using an explicit npm version.
• Pin the installed Skill to an immutable commit SHA or signed release artifact.
• Publish and verify cryptographic checksums or signatures for release contents.
• Document the expected npm publisher, repository, commit, and integrity value.
• Avoid automatically accepting lifecycle scripts from unreviewed packages.
• Prefer a lockfile-based or manually verified installation process in security-sensitive environments.

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/daily-tips-omni.mjs:158

Finding

Dormant Shell Command Injection in Reddit Fetcher

Content

View full analysis

Vulnerability Details

File Location: scripts/daily-tips-omni.mjs:158-166
Vulnerability Type: OS command injection through unsafe shell interpolation
Risk Level: Low

Vulnerable Code

javascript

async function fetchReddit(subreddit, limit = 10) {
  try {
    if (!REDDIT_SKILL) return { ok: false, error: 'reddit-readonly skill not found locally' };
    const { stdout } = await execAsync(`node ${REDDIT_SKILL} posts ${subreddit} --limit ${limit} --sort hot`);
    return JSON.parse(stdout);
  } catch (error) {
    return { ok: false, error: error.message };
  }
}

Technical Analysis

execAsync executes its string through a system shell. The resolved script path, subreddit, and limit are interpolated directly into that command without shell escaping or strict validation. Shell metacharacters in an attacker-controlled value could therefore terminate or extend the intended command.

In the reviewed version, fetchReddit() has no caller and is not reachable through the exposed CLI commands. The flaw is therefore dormant and is not presently exploitable through ordinary Skill usage. It would become exploitable if future code, imported use, or another execution path passed untrusted values to this function.

The configured Reddit helper represents potential network access, but it is never invoked by the current program. No evidence was found that preferences, credentials, environment variables, or other sensitive information are transmitted.

Attack Path

1. Future code exposes fetchReddit() to a CLI argument, Agent-controlled value, remote content, or another untrusted source.
2. An attacker supplies a value containing shell syntax, such as a command separator followed by an arbitrary command.
3. The value is interpolated into the command string.
4. execAsync passes the resulting string to the system shell.
5. The shell executes both the intended Node.js command and the inject ...[truncated 780 chars]

Remediation

View remediation

Remediation Suggestions

• Replace exec with execFile or spawn and pass each argument separately without invoking a shell.
• Invoke the current Node.js executable explicitly and use an argument array:

javascript

import { execFile } from 'child_process';
import { promisify } from 'util';

const execFileAsync = promisify(execFile);

const { stdout } = await execFileAsync(process.execPath, [
  REDDIT_SKILL,
  'posts',
  subreddit,
  '--limit',
  String(limit),
  '--sort',
  'hot'
]);

• Validate subreddit names against a restrictive allowlist such as letters, digits, and underscores.
• Parse limit as an integer and enforce a small minimum and maximum.
• Resolve and validate the helper path before execution, including confirming that it is a regular file under an approved Skill directory.
• Keep network retrieval disabled unless it is necessary for an explicitly requested feature.
• Add tests containing shell metacharacters to ensure values are treated exclusively as arguments.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (13)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence

Finding

The README instructs users to run npx skills add adelpro/daily-tips-omni without pinning a specific version of the skills package. Because npx resolves and executes the latest available package by default, a compromised, typosquatted, or maliciously updated package could execute arbitrary code on the user's system during installation.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The README claims the skill 'tracks your preferences and improves over time' and can save useful tips and skipped topics, but it provides no explanation of what data is stored, where it is stored, retention limits, or whether any data leaves the local environment. In a skill marketed for routine use and self-improvement, silent behavioral tracking can create privacy and trust risks, especially if users assume tips are passive content rather than stateful collection.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 80% confidence

Finding

The skill advertises executable Node.js commands and behavior such as fetching community sources and tracking preferences, but it does not declare an explicit tool scope or permissions model. That creates ambiguity about what the skill is allowed to access at runtime and increases the chance of overbroad environment or filesystem access through the backing script.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The trigger list includes broad phrases such as agent optimization, which are likely to appear in ordinary conversations unrelated to this specific skill. This can cause unintended invocation, exposing user context to the skill or causing unexpected execution paths.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The trigger agent self improvement is especially broad and can overlap with normal user requests about improving agents in general. In a system that auto-selects skills, this raises the risk of accidental activation and unintended data flow into a skill that also claims to fetch community content and track preferences.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill states that it fetches daily optimization tips from community sources and tracks user preferences, but it does not clearly disclose what data is collected, where it is stored, whether it leaves the local environment, or how long it is retained. This is a privacy and trust issue that becomes more serious because community-source fetching can involve external network access and preference tracking implies persistent state.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The install instruction uses npx skills add adelpro/daily-tips-omni without a pinned version, which can pull whatever package version is current at execution time. This is a supply-chain risk: a later compromised or malicious release could be installed and executed by users without review.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill builds a shell command and executes an external sibling script via exec, using interpolated values for the script path and arguments. This introduces unnecessary command-execution capability for a daily tips skill and creates command injection risk if the resolved path or arguments contain shell metacharacters, especially because one candidate path is derived from HOME and executed through a shell.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The script performs subprocess execution without any user-visible disclosure, which is risky in a skill marketed as simple daily tips. Hidden execution of other local code reduces user ability to assess what the skill does and can mask abuse if the external script or path resolution is compromised.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The inline documentation suggests community Reddit data is part of the operational behavior, yet the rest of the program serves tips exclusively from the static TIPS_DATABASE and never calls fetchReddit. This creates an intent mismatch between the documented role of the code and what the skill actually does.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The manifest describes a content-oriented tip skill, but the implementation maintains mutable state in saved-tips, skipped-topics, and preferences JSON files. While related to tip delivery, this is still behavior beyond simply providing tips and is not described in the manifest text.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The script writes to JSON files under data/ to save tips, skipped topics, and preferences. While some success messages are printed after certain operations, there is no upfront disclosure or comment warning users that invoking save/skip features modifies local files and persists state.

Content

No source excerpt is available for this finding.