MSW (Mock Service Worker)

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 5:24 AM UTC
• Version: 1.0.1

Overview

This is a coherent MSW documentation skill; the main risk is install hygiene, not hidden or malicious skill behavior.

Review the README install commands before use: prefer a pinned installer version and an immutable skill source such as a tag or commit, and avoid global installation unless you want this guidance available across projects. The skill content itself is ordinary MSW v2 guidance with examples that may call real services if copied into passthrough or bypass mocks.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: README.md:17

Finding

Unpinned Third-Party Installer and Mutable Skill Source

Content

View full analysis

Vulnerability Details

File Location: README.md:17-25
Vulnerability Type: Unpinned third-party package execution and mutable remote dependency
Risk Level: Medium

Vulnerable Code

bash

npx skills add anivar/msw-skill -g

Or with full URL:

bash

npx skills add https://github.com/anivar/msw-skill

Technical Analysis

The documented installation procedure invokes the skills npm package through npx without specifying an audited version. It also retrieves the Skill from a mutable repository reference rather than a verified commit SHA or immutable release artifact.

npx may download and execute the currently published version of the named package. Consequently, the code executed at installation time may differ from the version reviewed during this audit. Likewise, the GitHub repository reference can resolve to newer content after review.

This creates a supply-chain trust gap: compromise of the npm package, package-maintainer account, GitHub repository, or repository-maintainer account could replace the installer or Skill content with a malicious version. Global installation through -g further increases the persistence and scope of installed content.

The audited artifact itself contains no malicious scripts, encoded payloads, persistence mechanisms, SSH-key operations, credential harvesting, or unauthorized external transmission. The risk arises from the mutable installation chain documented in the README.

Attack Path

1. An attacker compromises the npm account that publishes the skills package, the package itself, the GitHub repository, or a maintainer account.
2. The attacker publishes a malicious package version or modifies the repository's default branch.
3. A user copies one of the documented installation commands.
4. npx resolves and executes the current, unpinned installer package.
5. The installer retrieves the current mutable repository content instead of the audited revision.
6. Malicious installer cod ...[truncated 844 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the installer package to a reviewed version:

   bash

   npx skills@<verified-version> add anivar/msw-skill
   

2. Pin the Skill source to a verified commit SHA or immutable, signed release rather than the repository's mutable default branch.
3. Publish and verify integrity hashes or signed provenance for release artifacts.
4. Avoid global installation by default. Prefer project-local installation to limit the scope of compromised content.
5. Document how users can inspect the resolved npm package and Skill contents before execution.
6. Use npm provenance, lockfiles where supported, protected release workflows, multi-factor authentication, and restricted publishing tokens.
7. Warn users not to run the installation command with administrative privileges.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (15)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 88% confidence

Finding

The README instructs users to run npx skills add anivar/msw-skill -g without pinning the skills package version. npx may resolve and execute the latest published package at install time, which creates a supply-chain risk if the package changes unexpectedly or is compromised. Because this is an installation command in documentation, users may copy-paste it directly, making the risk practical even though the content itself is not overtly malicious.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 88% confidence

Finding

The full-URL install example still relies on unpinned npx skills, so the executable fetched at runtime is not fixed to a known-safe version. Even though the target repository URL is explicit, the bootstrap command itself remains mutable and could expose users to arbitrary code execution if the skills package is maliciously updated or hijacked.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 86% confidence

Finding

This ecosystem reference includes another copy-pasteable npx skills add ... -g command without a pinned CLI version. Repeating the unsafe pattern across the README increases exposure and normalizes execution of mutable remote tooling, which is a common supply-chain weakness.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 86% confidence

Finding

The referenced install command uses npx skills without constraining the resolved package version. Users following the README may execute whatever version is current at the time, which can lead to unintended or malicious code execution if the package supply chain is compromised.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 86% confidence

Finding

This is another unpinned npx skills invocation in the README. While likely included for convenience, it still exposes users to executing a mutable external package, which is risky in any install instruction and especially relevant in AI-agent skill ecosystems where users may automate setup.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 86% confidence

Finding

The command shown here repeats the same unpinned runtime dependency on npx skills. The skill context makes this somewhat more dangerous because it targets AI-agent workflows, where tools may ingest and execute setup instructions with limited human scrutiny.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 86% confidence

Finding

This documentation line encourages execution of an unpinned npx skills command, preserving the same supply-chain exposure as the other findings. The issue is not the referenced skill topic, but the mutable installer bootstrap mechanism that can change over time without review.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 86% confidence

Finding

The final ecosystem install example also uses an unversioned npx skills command. Although this appears to be standard documentation boilerplate rather than malicious behavior, it still creates a real and repeatable supply-chain attack surface for anyone copying the command.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The trigger list includes broad natural-language phrases such as mentions of "msw", "mock service worker", and especially "api mocking", which can cause the skill to activate in contexts that are only loosely related to this package. Over-broad activation can inject irrelevant guidance into unrelated tasks, increasing the chance of misleading the agent or overriding more appropriate project-specific context.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/handler-api.md (reported line 89)May include surrounding context.

Absolute URL — Full URL match

typescript

http.get('https://api.example.com/user', resolver)

RegExp — Pattern matching

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/handler-api.md (reported line 143)May include surrounding context.

One-time handler

Automatically removed after the first matching request:

typescript

http.get('/api/data', resolver, { once: true })

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · AGENTS.md (reported line 370)May include surrounding context.

data: { user: { id: variables.id, name: 'John' } }, }) }) // If the app talks to both /graphql and https://api.github.com/graphql, // this handler intercepts GetUser on BOTH endpoints

text

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · rules/graphql-scope-with-link.md (reported line 23)May include surrounding context.

data: { user: { id: variables.id, name: 'John' } }, }) }) // If the app talks to both /graphql and https://api.github.com/graphql, // this handler intercepts GetUser on BOTH endpoints

text

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · rules/graphql-scope-with-link.md (reported line 30)May include surrounding context.

data: { user: { id: variables.id, name: 'John' } }, }) }) // If the app talks to both /graphql and https://api.github.com/graphql, // this handler intercepts GetUser on BOTH endpoints

text

Unbounded Resource Access

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.

Content

Scanner excerpt · rules/util-bypass-vs-passthrough.md (reported line 61)May include surrounding context.

md

## Why

`passthrough()` is for conditional mocking — "sometimes mock, sometimes real." `bypass()` is for response augmentation — "fetch the real data, then modify it before returning." Using them incorrectly leads to infinite request loops or unintended network calls.

Static analysis

No suspicious patterns detected.