Edgefinder Cli

• Outcome: Review
• Latest audit: Sep 15, 2026 · 12:35 AM UTC
• Version: 0.1.2

Overview

This skill appears purpose-built for EdgeFinder sports analysis, but it can automatically download and run an unpinned npm CLI at use time.

Review this skill before installing if you will rely on the npx fallback. Prefer installing a reviewed, pinned EdgeFinder CLI version yourself, avoid exposing unnecessary environment variables, and understand that the API key or login session is used for paid EdgeFinder access and portfolio data.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: scripts/run.sh:8

Finding

Unpinned npm Package Is Automatically Downloaded and Executed

Content

View full analysis

Vulnerability Details

File Location: scripts/run.sh:8
Related Locations: SKILL.md:6, SKILL.md:17
Vulnerability Type: Unpinned third-party dependency and automatic remote package execution
Risk Level: Medium

Vulnerable Code

sh

if command -v npx >/dev/null 2>&1; then
  exec npx -y @edgefinder/cli "$@"
fi

The corresponding package metadata and documentation also omit an exact version:

json

"package":"@edgefinder/cli"

markdown

The wrapper prefers the installed `edgefinder` binary and falls back to `npx -y @edgefinder/cli`.

Technical Analysis

The fallback invokes npx with -y, automatically accepting package installation and executing @edgefinder/cli without an exact version or integrity constraint. npm therefore resolves whichever package release is current at execution time. The effective executable can change after this Skill has been audited.

This creates a supply-chain trust boundary: the wrapper delegates local code execution to mutable registry content. A compromised package publisher, malicious future release, or npm package-distribution compromise could cause arbitrary attacker-controlled JavaScript and package lifecycle behavior to execute. The local script does not independently verify the downloaded artifact's version, checksum, provenance, or signature.

Attack Path

1. An attacker compromises the @edgefinder/cli publisher, its release pipeline, or the relevant package-distribution channel.
2. The attacker publishes a malicious release that is selected by npm's unversioned resolution.
3. A host invokes scripts/run.sh without an installed edgefinder executable but with npx available.
4. npx -y @edgefinder/cli automatically retrieves and executes the resolved package without user confirmation.
5. The malicious package runs with the privileges and environment of the user or Agent process.

Impact Assessment

A compromised dependency could execute arbitrary code with the ...[truncated 544 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin @edgefinder/cli to a reviewed exact version rather than relying on npm's current resolution.
2. Verify the downloaded package using an approved integrity hash, lockfile, trusted artifact registry, or equivalent provenance mechanism.
3. Remove the automatic npx -y fallback. Require an explicit, separately reviewed installation step when the binary is unavailable.
4. Prefer a locally installed dependency managed through a committed lockfile and reproducible deployment process.
5. Run the CLI with least privilege and a restricted environment. Pass only required environment variables and isolate filesystem and network access where practical.
6. Establish dependency monitoring and a controlled upgrade process so new releases are reviewed before execution.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

The skill explicitly documents a fallback to npx -y @edgefinder/cli, which fetches and executes the latest package version at runtime without version pinning or integrity verification. This creates a real supply-chain risk: if the upstream package is compromised, unpublished/republished, or a breaking release is pushed, agent executions could run attacker-controlled code or unexpected behavior.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The script falls back to executing npx -y @edgefinder/cli without pinning a specific package version, so each run may fetch whatever version is currently published under that package name. This creates a supply-chain risk: a compromised upstream package, malicious new release, or dependency confusion-style event could cause unreviewed code to run on the user's machine at invocation time.

Content

No source excerpt is available for this finding.