Tutorial Docs

• Outcome: Pass
• Latest audit: Sep 14, 2026 · 9:53 PM UTC
• Version: 1.1.4

Overview

This is a documentation-writing skill with no executable install behavior, but its sample API tutorial uses weaker dependency and API-key handling patterns that users should improve before copying.

Safe to install as a documentation aid, but do not copy the weather API example verbatim into user-facing docs. Revise generated tutorials to use verified dependencies, pinned versions where appropriate, environment variables or a secret store for API keys, and clear key revocation guidance.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: references/example-weather-api.md:59
• Finding: Unpinned and Unverifiable npm Dependency Installation## Vulnerability Details **File Location**: `references/example-weather-api.md`, lines 59–61 **Vulnerability Type**: Supply-chain exposure through an unpinned third-party dependency **Risk Level**: Medium ### Vulnerable Code ```bash npm install @example/weather-sdk ``` ### Technical Analysis The tutorial directs users to install `@example/weather-sdk` without specifying an exact version, lockfile integrity value, verified registry, or package provenance. The package and associated service identities are placeholders, so the project provides no basis for confirming that the installed package is authentic or controlled by a trusted publisher. npm installation can execute package lifecycle scripts such as `preinstall`, `install`, and `postinstall`. Consequently, a malicious, compromised, or dependency-confusion package could execute code during installation with the permissions of the user running npm. This executable dependency is not necessary to demonstrate the Skill's documentation-writing patterns; pseudocode or an explicitly non-operational example would satisfy the declared purpose with less risk. ### Attack Path 1. An attacker registers or compromises the package named `@example/weather-sdk`, or compromises one of its transitive dependencies. 2. A user follows the bundled tutorial and runs `npm install @example/weather-sdk`. 3. npm resolves an attacker-controlled package version because the tutorial does not pin or authenticate the expected artifact. 4. Malicious package code runs during installation or when the tutorial imports the SDK. 5. The code accesses data and resources available to the current OS user, potentially including project files, environment variables, developer credentials, and network access. ### Impact Assessment Successful exploitation could provide arbitrary code execution with the privileges of the user running npm. The affected scope may include the tutorial project, files readable or writ ...[truncated 328 chars]
• Remediation: ## Remediation Suggestions - Replace the placeholder dependency with an explicitly identified, official package from a documented registry. - Pin an audited exact version rather than allowing npm to select the current version. - Commit and verify a lockfile containing package integrity metadata. - Document how users can verify the package publisher, registry, and provenance. - Use `npm install --ignore-scripts` when package lifecycle scripts are not required. - Audit direct and transitive dependencies before publishing the tutorial. - Prefer non-executable pseudocode for a generic documentation-pattern example, since executing a third-party package is not required to teach tutorial structure.

T09 · Insecure Skill Coding Practices

Warning

• Location: references/example-weather-api.md:94
• Finding: API Key Embedded in Source Code and Entrusted to an Unverified SDK## Vulnerability Details **File Location**: `references/example-weather-api.md`, lines 94–111 **Vulnerability Type**: Plaintext credential handling and network disclosure risk **Risk Level**: Medium ### Vulnerable Code ```javascript const Weather = require('@example/weather-sdk'); const client = new Weather({ apiKey: 'your-api-key-here' // Replace with your key from Step 3 }); async function getWeather(city) { const data = await client.current(city); console.log(`Weather in ${city}:`); console.log(` Temperature: ${data.temp}°F`); console.log(` Conditions: ${data.conditions}`); } getWeather('San Francisco'); ``` The tutorial then explicitly instructs the reader to replace the placeholder in the source file with the real API key copied from the service dashboard. ### Technical Analysis The example places a real API credential directly in `weather.js` as plaintext. This contradicts the preceding warning not to commit or share the key and makes accidental exposure through source control, backups, copied code, screen sharing, or diagnostic collection more likely. Calling `client.current(city)` also gives the API key to the installed SDK and causes authentication information to be transmitted over the network. A network request is functionally relevant to a real weather API tutorial, but the example does not identify the SDK's destination endpoint, establish endpoint ownership, or document transport-security requirements. Because the SDK itself is unverified, users cannot determine from the tutorial where the credential will be sent. The behavior is not evidence of deliberate credential exfiltration: authenticated API calls ordinarily require credentials. Nevertheless, storing the key in source and passing it to an unverifiable dependency exceeds the secure minimum necessary to demonstrate an API integration. ### Attack Path **Source disclosure path:** 1. A user generates an API key and pastes ...[truncated 1121 chars]
• Remediation: ## Remediation Suggestions - Load the credential from an environment variable, for example: ```javascript const apiKey = process.env.WEATHER_API_KEY; if (!apiKey) { throw new Error('WEATHER_API_KEY is required'); } const client = new Weather({ apiKey }); ``` - Provide a `.env.example` containing only a placeholder and ensure `.env` is listed in `.gitignore`. - Do not instruct users to paste real credentials into source files. - Identify the expected API hostname and require HTTPS with valid certificate verification. - Use a verified official SDK, or demonstrate the request with a transparent client whose destination is explicit. - Recommend a narrowly scoped, short-lived tutorial credential with conservative quota and billing limits. - Explain how to revoke the tutorial key after completion. - Add secret-scanning checks before publication or source-control commits.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The manifest description says to use the skill when writing a tutorial, learning guide, getting-started or onboarding guide, beginner/introductory guide, or any learn-by-doing hands-on guide. Several of these phrases are broad and common in everyday documentation work, and the file does not provide explicit trigger boundaries or negative examples in the invocation description itself, which could lead to unintended matching.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The tutorial explicitly instructs users to paste a live API key directly into source code, which normalizes insecure secret handling and increases the chance the key will be committed to version control, shared in screenshots, or left in local files. Although there is a brief warning not to share or commit the key, the example still demonstrates the unsafe pattern instead of a safer default such as environment variables or a local secrets file excluded from source control.

Static analysis

No suspicious patterns detected.