MSW (Mock Service Worker)

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 5:24 AM UTC
• Version: 1.0.1

Overview

This is a coherent MSW documentation skill; the main risk is install hygiene, not hidden or malicious skill behavior.

Review the README install commands before use: prefer a pinned installer version and an immutable skill source such as a tag or commit, and avoid global installation unless you want this guidance available across projects. The skill content itself is ordinary MSW v2 guidance with examples that may call real services if copied into passthrough or bypass mocks.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: README.md:17
• Finding: Unpinned Third-Party Installer and Mutable Skill Source## Vulnerability Details **File Location**: `README.md:17-25` **Vulnerability Type**: Unpinned third-party package execution and mutable remote dependency **Risk Level**: Medium ### Vulnerable Code ```bash npx skills add anivar/msw-skill -g ``` Or with full URL: ```bash npx skills add https://github.com/anivar/msw-skill ``` ### Technical Analysis The documented installation procedure invokes the `skills` npm package through `npx` without specifying an audited version. It also retrieves the Skill from a mutable repository reference rather than a verified commit SHA or immutable release artifact. `npx` may download and execute the currently published version of the named package. Consequently, the code executed at installation time may differ from the version reviewed during this audit. Likewise, the GitHub repository reference can resolve to newer content after review. This creates a supply-chain trust gap: compromise of the npm package, package-maintainer account, GitHub repository, or repository-maintainer account could replace the installer or Skill content with a malicious version. Global installation through `-g` further increases the persistence and scope of installed content. The audited artifact itself contains no malicious scripts, encoded payloads, persistence mechanisms, SSH-key operations, credential harvesting, or unauthorized external transmission. The risk arises from the mutable installation chain documented in the README. ### Attack Path 1. An attacker compromises the npm account that publishes the `skills` package, the package itself, the GitHub repository, or a maintainer account. 2. The attacker publishes a malicious package version or modifies the repository's default branch. 3. A user copies one of the documented installation commands. 4. `npx` resolves and executes the current, unpinned installer package. 5. The installer retrieves the current mutable repository content instead of the audited revision. 6. Malicious installer cod ...[truncated 844 chars]
• Remediation: ## Remediation Suggestions 1. Pin the installer package to a reviewed version: ```bash npx skills@<verified-version> add anivar/msw-skill ``` 2. Pin the Skill source to a verified commit SHA or immutable, signed release rather than the repository's mutable default branch. 3. Publish and verify integrity hashes or signed provenance for release artifacts. 4. Avoid global installation by default. Prefer project-local installation to limit the scope of compromised content. 5. Document how users can inspect the resolved npm package and Skill contents before execution. 6. Use npm provenance, lockfiles where supported, protected release workflows, multi-factor authentication, and restricted publishing tokens. 7. Warn users not to run the installation command with administrative privileges.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (15)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 88% confidence
• Finding: The README instructs users to run `npx skills add anivar/msw-skill -g` without pinning the `skills` package version. `npx` may resolve and execute the latest published package at install time, which creates a supply-chain risk if the package changes unexpectedly or is compromised. Because this is an installation command in documentation, users may copy-paste it directly, making the risk practical even though the content itself is not overtly malicious.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 88% confidence
• Finding: The full-URL install example still relies on unpinned `npx skills`, so the executable fetched at runtime is not fixed to a known-safe version. Even though the target repository URL is explicit, the bootstrap command itself remains mutable and could expose users to arbitrary code execution if the `skills` package is maliciously updated or hijacked.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 86% confidence
• Finding: This ecosystem reference includes another copy-pasteable `npx skills add ... -g` command without a pinned CLI version. Repeating the unsafe pattern across the README increases exposure and normalizes execution of mutable remote tooling, which is a common supply-chain weakness.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 86% confidence
• Finding: The referenced install command uses `npx skills` without constraining the resolved package version. Users following the README may execute whatever version is current at the time, which can lead to unintended or malicious code execution if the package supply chain is compromised.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 86% confidence
• Finding: This is another unpinned `npx skills` invocation in the README. While likely included for convenience, it still exposes users to executing a mutable external package, which is risky in any install instruction and especially relevant in AI-agent skill ecosystems where users may automate setup.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 86% confidence
• Finding: The command shown here repeats the same unpinned runtime dependency on `npx skills`. The skill context makes this somewhat more dangerous because it targets AI-agent workflows, where tools may ingest and execute setup instructions with limited human scrutiny.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 86% confidence
• Finding: This documentation line encourages execution of an unpinned `npx skills` command, preserving the same supply-chain exposure as the other findings. The issue is not the referenced skill topic, but the mutable installer bootstrap mechanism that can change over time without review.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 86% confidence
• Finding: The final ecosystem install example also uses an unversioned `npx skills` command. Although this appears to be standard documentation boilerplate rather than malicious behavior, it still creates a real and repeatable supply-chain attack surface for anyone copying the command.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The trigger list includes broad natural-language phrases such as mentions of "msw", "mock service worker", and especially "api mocking", which can cause the skill to activate in contexts that are only loosely related to this package. Over-broad activation can inject irrelevant guidance into unrelated tasks, increasing the chance of misleading the agent or overriding more appropriate project-specific context.

External Transmission

Medium

• Category: Data Exfiltration

Content

### Absolute URL — Full URL match

```typescript
http.get('https://api.example.com/user', resolver)
```

### RegExp — Pattern matching

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

### One-time handler

Automatically removed after the first matching request:

```typescript
http.get('/api/data', resolver, { once: true })

• Confidence: 80% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

External Transmission

Medium

• Category: Data Exfiltration

Content

data: { user: { id: variables.id, name: 'John' } },
  })
})
// If the app talks to both /graphql and https://api.github.com/graphql,
// this handler intercepts GetUser on BOTH endpoints
```

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

data: { user: { id: variables.id, name: 'John' } },
  })
})
// If the app talks to both /graphql and https://api.github.com/graphql,
// this handler intercepts GetUser on BOTH endpoints
```

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

data: { user: { id: variables.id, name: 'John' } },
  })
})
// If the app talks to both /graphql and https://api.github.com/graphql,
// this handler intercepts GetUser on BOTH endpoints
```

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Unbounded Resource Access

Medium

• Category: Excessive Agency

Content

## Why

`passthrough()` is for conditional mocking — "sometimes mock, sometimes real." `bypass()` is for response augmentation — "fetch the real data, then modify it before returning." Using them incorrectly leads to infinite request loops or unintended network calls.

• Confidence: 80% confidence
• Finding: Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.

Static analysis

No suspicious patterns detected.