T08 · Insecure Dependencies
Warning
- Location
README.md:10- Finding
Unpinned npx Package Creates a Mutable Installation Execution Chain
- Content
View full analysis
- Remediation
View remediation
Security audit
alon-github-security-audit
Security checks for vulnerabilities and agentic risk
Overview
This is a disclosed static security-review skill that clones GitHub targets and writes local reports, with hardening issues but no evidence of malicious behavior.
Before installing, pin or verify the `npx skills` installer source if possible, and be aware that audits read the target repository and write a persistent local report that may contain repository names, paths, and findings. The cleanup helper should only be used on clone directories created by this skill until its path validation is tightened.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
tools/cleanup.py:23- Finding
Weak Temporary-Directory Validation Permits Recursive Deletion of Unrelated Paths
- Content
View full analysis
``` ...[truncated 1021 chars]- Remediation
View remediation
Vulnerability Patterns
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
Findings (22)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The skill claims to perform a comprehensive static security audit, but the file mainly provides instructions and shell steps for cloning, cleanup, and report-writing without any concrete embedded auditing logic or enforceable checks. That mismatch is dangerous because users may trust the skill as a security control when it may only orchestrate limited actions, creating false assurance around malicious repositories.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - always inspect whether the repository can poison persistent agent state such as `USER.md`, `MEMORY.md`, `AGENTS.md`, `SOUL.md`, `IDENTITY.md`, and `SKILL.md`
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - always inspect whether the repository can poison persistent agent state such as `USER.md`, `MEMORY.md`, `AGENTS.md`, `SOUL.md`, `IDENTITY.md`, and `SKILL.md`
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - always inspect whether the repository can poison persistent agent state such as `USER.md`, `MEMORY.md`, `AGENTS.md`, `SOUL.md`, `IDENTITY.md`, and `SKILL.md`
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - always inspect whether the repository can poison persistent agent state such as `USER.md`, `MEMORY.md`, `AGENTS.md`, `SOUL.md`, `IDENTITY.md`, and `SKILL.md`
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - always inspect whether the repository can poison persistent agent state such as `USER.md`, `MEMORY.md`, `AGENTS.md`, `SOUL.md`, `IDENTITY.md`, and `SKILL.md`
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - always inspect whether the repository can poison persistent agent state such as `USER.md`, `MEMORY.md`, `AGENTS.md`, `SOUL.md`, `IDENTITY.md`, and `SKILL.md`
Self-Modification
High
- Category
- Rogue Agent
- Confidence
- 90% confidence
- Finding
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
- Content
md - look for `npm install`, lockfile deletion, unpinned third-party actions, and sensitive output 2. Documentation and prompt-injection review - inspect `README.md`, install docs, tutorials, `SKILL.md`, script comments, and issue templates - look for copy-paste command traps, instructions to disable safety rules, or hidden execution intent - pay special attention to patterns like `curl | sh`, `bash <(curl ...)`, `irm ... | iex`, log deletion, disabled verification, or confirmation bypass 3. Hardcoded secret classification - distinguish public client keys, private API keys, and webhook secrets
YARA rule 'agent_skill_prompt_injection_hidden_instructions': Prompt injection or hidden instructions embedded in AI agent skill text [agent_skills]
High
- Category
- YARA Match
- Confidence
- 80% confidence
- Finding
YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
- Content
md on review - inspect `.github/workflows/*.yml`, `.gitlab-ci.yml`, `Jenkinsfile`, and `Dockerfile` - look for `npm install`, lockfile deletion, unpinned third-party actions, and sensitive output 2. Documentation and prompt-injection review - inspect `README.md`, install docs, tutorials, `SKILL.md`, script comments, and issue templates - look for copy-paste command traps, instructions to disable safety rules, or hidden execution intent - pay special attention to patterns like `curl | sh`, `bash <(curl ...)`, `irm ... | iex`, log deletion, disabled verification, or confirmation bypass 3. Hardcoded secret classification - distinguish public client keys, private API keys, and webhook secrets - do not treat every key-looking string as equally malicious without context 4. Environment-variable purpose analysis - distinguish feature flags, telemetry controls, tool detection variables, and real credentials 5. Network-request safety - check for missing timeouts - chec
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
- Content
md 2. Documentation and prompt-injection review - inspect `README.md`, install docs, tutorials, `SKILL.md`, script comments, and issue templates - look for copy-paste command traps, instructions to disable safety rules, or hidden execution intent - pay special attention to patterns like `curl | sh`, `bash <(curl ...)`, `irm ... | iex`, log deletion, disabled verification, or confirmation bypass 3. Hardcoded secret classification - distinguish public client keys, private API keys, and webhook secrets - do not treat every key-looking string as equally malicious without context
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
- Content
md 2. Documentation and prompt-injection review - inspect `README.md`, install docs, tutorials, `SKILL.md`, script comments, and issue templates - look for copy-paste command traps, instructions to disable safety rules, or hidden execution intent - pay special attention to patterns like `curl | sh`, `bash <(curl ...)`, `irm ... | iex`, log deletion, disabled verification, or confirmation bypass 3. Hardcoded secret classification - distinguish public client keys, private API keys, and webhook secrets - do not treat every key-looking string as equally malicious without context
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md - flag actions pinned only to branches or mutable tags such as `@main`, `@master`, or broad major tags - prefer full commit SHA for high-trust release, publish, or secret-bearing workflows 5. registry and dependency-confusion surface - inspect `.npmrc`, `.yarnrc.yml`, `pip.conf`, `pyproject.toml`, package scopes, and CI registry config - flag private-looking unscoped package names, mixed public/private registries, missing scope-to-registry mapping, or fallback-to-public behavior 6. execution amplifiers - identify lifecycle scripts, native binary downloads, remote installer scripts, `curl | sh`, package publish workflows, and tag-triggered release automation
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 84% confidence
- Finding
The install command uses
npx skillswithout pinning an exact package version, so users may execute whatever version is currently resolved from the registry at install time. In a security-audit skill, this is more concerning because users are likely to trust the tool with sensitive repositories and local filesystem access, increasing the damage if the upstream package is compromised or a malicious version is published.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
L026-L027 的示例触发语
audit this repo和check repo security缺少更明确的上下文约束，属于较宽泛的自然语言表达。在支持自然语言调用的环境中，这类短语容易与一般性讨论或普通请求重叠，增加非预期触发的风险。- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 96% confidence
- Finding
The skill explicitly instructs the agent to run shell commands (
python3 tools/clone_repo.py,python3 tools/cleanup.py,cp ...) but does not declare any tool scope or allowed-tools boundary. In an agent setting, undeclared shell capability weakens policy transparency and can lead to overbroad execution authority relative to what installers or runtimes expect.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The module docstring, function docstring, and user-facing usage text are written only in Chinese, which imposes a specific language on users without any opt-in or explanation of a region-specific requirement. The policy allows locale constraints only when they are optional or clearly justified, which is not present here.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This Python file contains user-facing docstrings and console messages entirely in Chinese, including the usage text and operational status output. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation unless the constraint is explicitly justified, which is not present here.
- Content
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python try: # 执行浅克隆 result = subprocess.run( ['git', 'clone', '--depth', '1', repo_url, clone_dir], capture_output=True, text=True,
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 76% confidence
- Finding
该文件主体内容全部为中文，且未在正文中说明用户可在交互中选择其他语言。根据语言/区域政策检查标准，若技能内容限定特定语言而缺少显式选择或适用性说明，可能构成语言策略上的限制。
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The document states that the skill writes a structured audit report to a local directory, but the warning is not especially prominent at the point where outputs are described. Even local-only writes can matter in security workflows because they may create persistent artifacts containing repository names, findings, or sensitive paths without clear user expectation.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill defaults to writing audit reports to local directories such as a configured path or
~/Security-Audit/, but this side effect is not clearly disclosed in the short description. Silent local writes are lower severity than code execution, but they can surprise users, leak repository metadata into persistent storage, or create privacy concerns on shared systems.- Content