Redux Saga

• Outcome: Review
• Latest audit: Sep 11, 2026 · 5:24 AM UTC
• Version: 1.0.1

Overview

The skill is mostly normal Redux-Saga guidance, but its README recommends unpinned global installation commands that can fetch mutable remote code and persistently change agent behavior.

Before installing, prefer a pinned package version or immutable commit and avoid global `-g` installation unless you intentionally want this skill available across agent contexts. Treat the analytics, auth-token, and storage snippets as examples to adapt with normal privacy and security controls.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: README.md:17

Finding

Unpinned Remote Package Execution with Global Installation Scope

Content

View full analysis

Vulnerability Details

File Location: README.md, lines 17-24
Vulnerability Type: Unpinned dependency execution and mutable remote installation source
Risk Level: Medium

bash

npx skills add anivar/redux-saga-skill -g

Or with full URL:

bash

npx skills add https://github.com/anivar/redux-saga-skill

Technical Analysis

The documented installation commands rely on mutable remote dependencies. The first command invokes npx without pinning the skills CLI to an audited version. Depending on the local environment and package availability, npx may download and execute the current package release. The -g option requests global installation scope, which is broader than required to consume the Skill locally.

The alternative command installs directly from a GitHub repository URL without specifying an immutable commit SHA. Consequently, the content installed later may differ from the content reviewed during this audit.

The repository itself contains documentation rather than an automatically executed malicious payload. Exploitation therefore requires a user or agent to follow one of these installation instructions after the relevant package or upstream source has been compromised or changed.

Attack Path

1. An attacker compromises the unpinned skills package, its publication account, its dependency chain, or the referenced GitHub repository.
2. The attacker publishes or commits a malicious revision while retaining the expected package or repository identity.
3. A user follows the README and executes one of the documented installation commands.
4. npx retrieves and executes mutable package code, or the installer retrieves mutable repository content.
5. The malicious code runs with the invoking user's privileges and may alter globally installed Skill state when -g is used.

Impact Assessment

Successful exploitation could execute attacker-controlled code with the permission ...[truncated 567 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the CLI to a reviewed exact version, for example by using an explicitly versioned package reference rather than an unqualified npx skills invocation.
2. Pin repository-based installation to an audited commit SHA instead of a mutable branch or repository URL.
3. Remove -g from the default command and recommend project-local or user-scoped installation. Document global installation only as an optional operation with a clear explanation of its scope.
4. Publish and verify integrity information, such as package-manager lockfile metadata, registry integrity hashes, signed releases, or commit-signature verification.
5. Recommend reviewing the resolved package version and source before approving execution, particularly in automated agent environments.
6. Avoid automatically confirming npx installation prompts in CI or agent workflows, and restrict installation processes using sandboxing and least-privilege filesystem permissions.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (13)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 164)May include surrounding context.

md

For the complete guide with all rules expanded: `AGENTS.md`

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 89% confidence

Finding

The README instructs users to execute npx skills add ... without pinning the version of the skills package or tool being fetched. This creates a supply-chain risk: a future compromised or maliciously updated package/version could be executed on the user's machine at install time. Because this is an installation command in documentation for an AI agent skill, users are likely to copy-paste it directly, increasing practical exploitability.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 89% confidence

Finding

This line again directs users to run npx skills add with a full URL but still without pinning an exact version or immutable reference. Even with a GitHub URL, unpinned installation can resolve to moving targets such as changed default branches or updated package contents, enabling supply-chain compromise if the upstream source is altered. The README context makes this more dangerous because it is framed as the canonical install path.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 86% confidence

Finding

The ecosystem table includes another unpinned npx skills add command. Repetition of unsafe install patterns across documentation broadens the attack surface by normalizing execution of mutable remote code and increasing the chance that users will run one of these commands without scrutiny. In a skill-distribution context, copy-pasteable install commands are particularly sensitive.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 86% confidence

Finding

This installation example references another skill via npx skills add without an exact pinned version. That leaves users exposed to whatever package or repository state is current at execution time, which can become dangerous if the dependency chain is hijacked or the package is maliciously updated. The presence in a curated 'skills' ecosystem may make users trust it more than they should.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 86% confidence

Finding

The README continues the same unpinned install pattern for another related skill. While likely not malicious, it still introduces a real supply-chain vulnerability because the command fetches and executes code that may change over time. The skill context increases risk slightly because developers may automate or batch-install such tools from docs.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 86% confidence

Finding

This line presents another mutable npx-based install command for a skill package. Any compromise of the package publication path, namespace, or underlying installer could result in arbitrary code execution during installation. The danger is not in redux-saga content itself, but in the documentation's distribution mechanism.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 86% confidence

Finding

This npx skills add example for zod-skill is also unpinned. Such commands are a recognized supply-chain hazard because they delegate trust to the latest available remote package state, which may be altered after the README is published. The ecosystem-listing context can amplify impact by encouraging broad adoption through convenience.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 86% confidence

Finding

Another skill-install command is shown without any version pinning. If the package, account, or dependency graph is compromised, users following this command could execute attacker-controlled code locally. Because README install sections are high-trust and high-copy-paste surfaces, this is a meaningful documentation security issue.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 86% confidence

Finding

The final listed npx skills add command repeats the same unsafe pattern of invoking unpinned remote tooling. Although likely included for convenience, it still represents a true supply-chain vulnerability pattern because the executed content is not fixed to a known-good version. The broader skill marketplace context makes consistency important: repeated unsafe examples can propagate insecure norms.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger list includes broad natural-language terms such as "saga" and references to common Redux-Saga concepts, which can cause the skill to activate in files or contexts that only mention those words incidentally. Overbroad activation increases the chance that the agent will apply irrelevant guidance, pollute context, or influence behavior in unrelated tasks.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The example sets locale: 'en-US' directly in context, which presents a fixed language/locale choice without any indication that users can select or override it. Under the policy criteria, hard-coded locale choices in natural-language or example content can be a language/locale policy violation when not documented as optional or region-specific.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

This markdown file includes example code that buffers ANALYTICS_EVENT actions and sends them via api.sendAnalyticsBatch, which implies transmission of potentially user-related telemetry. The surrounding documentation does not disclose that analytics events are being collected and sent, so readers could adopt the pattern without any warning about privacy-impacting behavior.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.