mistro-connect

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 7:55 PM UTC
• Version: 1.0.4

Overview

The skill is a coherent Mistro integration with disclosed network, credential, and messaging behavior; the main caution is its unpinned global npm CLI install.

Install only if you trust the Mistro npm package and service. Consider pinning a reviewed package version, using a restricted environment, and rotating the MISTRO_API_KEY if you later suspect the CLI or account was compromised.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:31

Finding

Unpinned Global Installation of a Third-Party Executable

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 31–46
Vulnerability Type: Unpinned third-party npm dependency
Risk Level: Medium

Vulnerable Code

yaml

install:
  - kind: node
    package: mistro.sh
    bins: [mistro]

bash

npm install -g mistro.sh

Technical Analysis

The skill directs users to install the latest available version of the third-party mistro.sh package without specifying an exact version or verifying an integrity hash. The package is installed globally and exposes the mistro executable.

Because no package source, lockfile, version constraint, or integrity value is included in the audited project, the effective code installed by this command can change after the skill has been reviewed. The documentation's claims that the package has no post-install scripts and limits its filesystem and network activity cannot be independently verified from the provided artifact.

This creates a supply-chain risk: compromise of the npm publisher account, package ownership, release process, or upstream dependency tree could cause users to install attacker-controlled code.

Attack Path

1. An attacker compromises the mistro.sh npm publisher account, release pipeline, or a dependency included in a future package release.
2. The attacker publishes a malicious version under the existing package name.
3. A user follows the documented npm install -g mistro.sh instruction.
4. npm resolves the mutable default version and installs the compromised package globally.
5. Malicious lifecycle code may execute during installation, or malicious CLI code executes when the user invokes mistro.
6. The malicious process runs with the installing user's privileges and may access user-readable data, including the documented Mistro credentials.

Impact Assessment

Successful exploitation could permit arbitrary code execution with the privileges of the user performing the insta ...[truncated 683 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the package to an exact reviewed version, for example:

   bash

   npm install -g mistro.sh@1.0.0
   

2. Publish and verify the expected npm integrity hash or package digest through a trusted channel before installation.
3. Include the relevant source code, dependency manifest, and lockfile in the review scope so package behavior and transitive dependencies can be audited.
4. Prefer a project-local installation over a global installation, and invoke the pinned binary from that controlled environment.
5. Run installation and execution under a dedicated, unprivileged account or sandbox with restricted filesystem and network access.
6. Disable lifecycle scripts during installation when they are not required:

   bash

   npm install --ignore-scripts --save-exact mistro.sh@1.0.0
   

7. Continuously monitor the pinned package and its transitive dependencies for ownership changes, unexpected releases, known vulnerabilities, and integrity changes.
8. Protect ~/.config/mistro/config.json with restrictive file permissions and provide credential rotation procedures for suspected package compromise.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.