Security checks for vulnerabilities and agentic risk
Overview
The skill appears to do its advertised StrikeRadar lookup, but its install and run paths execute unpinned npm tooling from the network and need review before use.
Review before installing. Prefer cloning a reviewed commit and running with a locally installed, pinned `tsx` version or a lockfile-managed workflow instead of copy-pasting the unpinned `npx` commands. Expect the skill to contact api.usstrikeradar.com when used, and avoid relying on its risk scores for safety, financial, or operational decisions.
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
T08 · Insecure Dependencies
Warning
Location
SKILL.md:20
Finding
Unpinned npm Packages Are Executed Through npx
Content
View full analysis
Vulnerability Details
File Location: SKILL.md:20-23; additional occurrences in README.md:10-13 and README.md:35-38 Vulnerability Type: Unpinned third-party package execution through npx Risk Level: Medium
Vulnerable Code
SKILL.md:20-23:
bash
## Quick Start
No dependencies needed. Run directly:
```bash
npx tsx {baseDir}/scripts/strikeradar.ts status
`README.md:35-38`:
```bash
Or run it as a standalone CLI:
```bash
npx tsx scripts/strikeradar.ts status
text
### Technical Analysis
The documented installation and execution paths invoke the npm packages `skills` and `tsx` through `npx` without specifying exact versions or integrity constraints. Neither package is declared or locked in `package.json`, which contains no dependency list or lockfile-backed resolution.
When a requested executable is not already installed locally, `npx` can resolve and download a package from the configured npm registry and immediately execute its package code. Because no version is pinned, the effective executable can change after this skill has been reviewed. A future compromised, malicious, or otherwise unsafe package release could therefore execute during skill installation or normal use.
This is a supply-chain weakness rather than evidence that the currently resolved packages are malicious. Exploitation requires compromise of the relevant package, registry resolution, maintainer account, or package source.
### Attack Path
1. An attacker compromises the npm package or publishing account for `tsx` or `skills`, or otherwise influences package resolution through the user's npm registry configuration.
2. The attacker publishes a malicious version that contains executable package logic.
3. A user or agent follows the documented command without an already tru
...[truncated 1270 chars]
Remediation
View remediation
Remediation Suggestions
Declare required runtime tooling in package.json using reviewed, exact versions rather than relying on unconstrained registry resolution. For example, pin tsx to an exact version without a caret or tilde.
Commit a lockfile generated by the selected package manager and require lockfile-enforced installation, such as npm ci, before execution.
Replace the documented npx tsx ... command with an invocation of the installed, lockfile-controlled executable, such as an npm script:
json
If npx must remain supported, specify an explicitly reviewed version and prevent silent alternative resolution. Version pinning reduces unexpected upgrades, although a committed lockfile and local installation provide stronger reproducibility.
Pin or otherwise verify the installer used in npx skills add ...; document its expected package identity and reviewed version.
Use a trusted npm registry, retain package integrity metadata, and incorporate dependency provenance, vulnerability, and publisher-change checks into release review.
Run installation and skill execution in a restricted environment with minimal filesystem access, no unnecessary credentials in environment variables, and limited outbound network permissions.
The README instructs users to run npx skills add alexpolonsky/agent-skill-strikeradar without pinning a specific package version. Because npx resolves and executes the current published package, a compromised publisher account, malicious update, or dependency-chain issue could cause arbitrary code execution on the user's machine at install time.
Content
No source excerpt is available for this finding.
Rp1
Medium
Category
MCP Rug Pull
Confidence
91% confidence
Finding
The standalone CLI example uses npx tsx scripts/strikeradar.ts status without pinning tsx to a known version. This causes npx to fetch and execute whichever tsx release is current in the user's environment, creating a supply-chain execution risk if the package or its distribution path is ever compromised.
Content
No source excerpt is available for this finding.
Rp1
Medium
Category
MCP Rug Pull
Confidence
91% confidence
Finding
The alias example again relies on unpinned npx tsx, which means every invocation may execute a package version not reviewed by the skill author or user. In a skill context, README commands are often copy-pasted directly, so this increases the practical risk of supply-chain compromise through routine usage.
Content
No source excerpt is available for this finding.
Undeclared Tool Scope
Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding
The skill invokes a script that fetches multiple external signals, but the manifest does not declare any tool scope or permissions boundary for network access. This creates an execution/transparency gap: users and hosting platforms cannot reliably constrain or review what outbound access the skill needs, increasing the risk of unexpected data retrieval or abuse if the script changes.
Content
No source excerpt is available for this finding.
Vague Triggers
Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding
The trigger phrases are broad current-events terms such as 'Iran situation' and 'oil prices Iran', which are likely to match ordinary conversation and auto-activate the skill outside clear user intent. Over-broad activation can cause unintended network access, unexpected geopolitical monitoring behavior, or disclosure of outputs the user did not explicitly request.
Content
No source excerpt is available for this finding.
Rp1
Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding
Using npx tsx without pinning an exact version allows the runtime to resolve and execute whatever package version is current at execution time. This introduces a supply-chain risk where a malicious or compromised upstream release of tsx could execute arbitrary code on the host when the skill is run.
Content
No source excerpt is available for this finding.
Rp1
Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding
This command again relies on unpinned npx tsx, which means code from the npm ecosystem is fetched/resolved dynamically at runtime without a fixed version guarantee. In a skill that users may execute repeatedly, this materially increases exposure to dependency hijacking or malicious package updates.
Content
No source excerpt is available for this finding.
Rp1
Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding
The signal command uses the same unpinned npx tsx execution path, so the host may execute unreviewed upstream code before running the local script. Because this command is intended for targeted investigation, users may trust it in sensitive contexts while still being exposed to arbitrary package behavior.
Content
No source excerpt is available for this finding.
Rp1
Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding
The pulse example repeats the unpinned npx tsx pattern, preserving the same supply-chain execution risk. Any compromise of the package or dependency resolution path could lead to arbitrary code execution with the user's privileges.
Content
No source excerpt is available for this finding.
Rp1
Medium
Category
MCP Rug Pull
Confidence
94% confidence
Finding
Piping the command output does not reduce the underlying risk that npx tsx may fetch and execute an unexpected package version. The danger is amplified because the example encourages a standard usage pattern that may be widely copied by users without scrutiny.
Content
No source excerpt is available for this finding.
Rp1
Medium
Category
MCP Rug Pull
Confidence
93% confidence
Finding
The shebang uses npx tsx, which resolves and may download whatever version of tsx is current in the execution environment rather than a pinned, audited dependency. That creates a supply-chain risk: a compromised or breaking upstream release could execute unexpected code whenever this script is launched.
Content
No source excerpt is available for this finding.
Natural-Language Policy Violations
Low
Category
Not specified by scanner
Confidence
79% confidence
Finding
The description explicitly includes Hebrew trigger phrases alongside English phrases, but it does not explain whether multilingual activation is user-selected or optional. This can be a language/locale policy issue because the skill defines language-specific behavior without documenting user opt-in or locale constraints.
Content
No source excerpt is available for this finding.
Missing User Warnings
Low
Category
Not specified by scanner
Confidence
84% confidence
Finding
The script performs outbound HTTP requests to api.usstrikeradar.com, including a POST request, but the file provides no user-facing disclosure that running the command will contact a third-party service and share request metadata such as IP address and usage context. For a code file, this qualifies as a missing warning because the network transmission is not accompanied by a confirmation prompt or explicit disclosure in comments/docstrings beyond naming the API.
