Jest

• Outcome: Review
• Latest audit: Sep 11, 2026 · 5:26 AM UTC
• Version: 1.0.0

Overview

The Jest guidance itself is coherent and non-agentic, but its documentation recommends unpinned global installation from mutable remote sources.

Review the skill content itself as ordinary Jest documentation, but avoid the documented unpinned global install in sensitive environments. Prefer a project-scoped install from an immutable release or commit and a pinned installer version, and verify the source before enabling it across projects.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: README.md:17

Finding

Unpinned Third-Party Installer Executes Mutable Remote Content

Content

View full analysis

Vulnerability Details

File Location: README.md, lines 17–24
Vulnerability Type: Unpinned dependency execution and mutable remote installation
Risk Level: Medium

Vulnerable Code

bash

npx skills add anivar/jest-skill -g

bash

npx skills add https://github.com/anivar/jest-skill

Technical Analysis

The installation instructions invoke npx skills without pinning the skills package to a reviewed version or verifying its integrity. Depending on the local environment and npx behavior, this can download and execute the currently published package under the invoking user's account.

The second command additionally installs Skill content from a mutable GitHub repository reference without pinning it to an immutable commit. Consequently, the effective installer and installed Skill content can differ from the versions covered by this audit.

The global installation flag in the first command increases scope by making the installed Skill available beyond one project. This does not demonstrate that the current package is malicious, but it creates a supply-chain trust boundary that is not constrained by version or integrity controls.

Attack Path

1. An attacker compromises the npm package used by npx skills, its publisher account, or a transitive dependency.
2. Alternatively, the attacker compromises the referenced GitHub repository or its maintainer account.
3. The attacker publishes a malicious package version or changes the repository's mutable default branch.
4. A user follows one of the documented installation commands.
5. npx retrieves and executes the unpinned installer under the user's privileges.
6. The installer retrieves mutable Skill content and, with the global form, installs it into a cross-project location.
7. Malicious installer code could access resources available to the invoking user, while malicious Skill instructions could affect later agent sessions in which the globally installed Skill is loaded.

...[truncated 867 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the skills installer to a specifically reviewed version rather than invoking the mutable latest release:

   bash

   npx --yes skills@<audited-version> add ...
   

2. Pin repository installation to an immutable commit SHA or cryptographically verified release tag where the installer supports it.

3. Publish expected commit identifiers or checksums and instruct users to verify downloaded content before installation.

4. Avoid global installation by default. Recommend project-scoped installation and document the additional trust implications of -g separately.

5. Use lockfiles, provenance attestations, signed releases, and registry integrity metadata for the installer and its transitive dependencies.

6. In security-sensitive environments, require users to download and inspect the pinned installer and Skill content before executing or enabling them.

7. Add an explicit warning that npx can download and execute packages and that repository URLs without commit pins may resolve to content different from the audited revision.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (53)

Memory Manipulation

High

• Category: Memory Poisoning
• Confidence: 80% confidence

Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · SKILL.md (reported line 83)May include surrounding context.

md

---
title: Each test must be independent; reset state in beforeEach
impact: HIGH
description: Tests that depend on execution order or shared mutable state create flaky failures. Reset all shared state in beforeEach.
tags: structure, isolation, beforeEach, shared-state, flaky

Memory Manipulation

High

• Category: Memory Poisoning
• Confidence: 80% confidence

Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · references/ci-and-debugging.md (reported line 193)May include surrounding context.

md

---
title: Each test must be independent; reset state in beforeEach
impact: HIGH
description: Tests that depend on execution order or shared mutable state create flaky failures. Reset all shared state in beforeEach.
tags: structure, isolation, beforeEach, shared-state, flaky

Memory Manipulation

High

• Category: Memory Poisoning
• Confidence: 80% confidence

Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · rules/structure-test-isolation.md (reported line 2)May include surrounding context.

md

---
title: Each test must be independent; reset state in beforeEach
impact: HIGH
description: Tests that depend on execution order or shared mutable state create flaky failures. Reset all shared state in beforeEach.
tags: structure, isolation, beforeEach, shared-state, flaky

Memory Manipulation

High

• Category: Memory Poisoning
• Confidence: 80% confidence

Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · rules/structure-test-isolation.md (reported line 8)May include surrounding context.

md

---
title: Each test must be independent; reset state in beforeEach
impact: HIGH
description: Tests that depend on execution order or shared mutable state create flaky failures. Reset all shared state in beforeEach.
tags: structure, isolation, beforeEach, shared-state, flaky

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

The README instructs users to run npx skills add ... without pinning the version of the skills package/CLI being fetched and executed. This creates a supply-chain risk: future compromised, malicious, or breaking versions of the package could be executed automatically on the user's machine at install time.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

This line again recommends npx skills add ... with no pinned version, which means the executed tool is resolved dynamically at runtime. If the upstream package is ever hijacked or a bad release is published, users may execute attacker-controlled code simply by following the README.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence

Finding

The companion-skill installation example uses unpinned npx skills, exposing the same dynamic package-resolution risk. Because README examples are commonly copy-pasted, this materially increases the chance of users executing an unexpected or malicious package version.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence

Finding

This installation command relies on an unpinned npx skills invocation, which can fetch and run whichever version is current at execution time. That weakens reproducibility and opens a supply-chain execution path if the package or dependency chain is compromised.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence

Finding

The line contains another unversioned npx skills example, making users dependent on mutable upstream state when executing code from the network. In documentation, repeated unsafe install commands amplify exposure because users often trust official examples without additional verification.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence

Finding

This command is a true supply-chain risk because npx executes a package resolved at runtime without an explicit version constraint shown here. An attacker who gains control of the package publishing path or dependency chain could abuse that trust to run arbitrary code on user systems.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence

Finding

The README includes yet another unpinned npx skills command for a related skill, carrying the same risk of executing a mutable upstream package version. While likely not malicious, the pattern normalizes unsafe installation behavior across the ecosystem.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence

Finding

This line exposes users to unpinned remote code execution through npx, which is especially relevant because users may execute it directly from the README. The skill context does not reduce the danger; although this is a testing skill, the install action still runs code on the host machine.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence

Finding

The same unversioned install pattern appears here, making the command susceptible to future package compromise or accidental breaking changes. Because documentation implicitly endorses the command, users may not realize they are executing code from a mutable source.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence

Finding

This final npx skills example is also a true vulnerability pattern: it tells users to execute an unpinned package fetched at runtime. The broader context of a developer tool skill makes this moderately dangerous because the likely audience has local source code, tokens, and CI credentials that could be exposed if the package were compromised.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The trigger list includes very broad terms such as mentions of "jest", "unit test", "test suite", or "mock", which can cause the skill to activate during ordinary developer conversation rather than only when clearly needed. This increases prompt-surface exposure and the chance that unrelated or adversarial user content gets routed through the skill unnecessarily, though the skill itself is non-agentic and does not execute actions.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.