Security audit

Zod Testing

Security checks for vulnerabilities and agentic risk

Overview

This is a visible documentation-only skill for Zod schema testing, with install and dependency commands that users should review and pin before running.

Before installing, prefer pinned versions or an immutable commit and consider a project-local install instead of the documented global command. If using the dependency and CI examples, review packages first, commit lockfiles, and keep generated snapshots and git-diff checks limited to the intended project paths.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

Location: README.md:15
Finding: Unpinned Third-Party Packages and Mutable Repository Sources
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (12)

Rp1

Medium

Category: MCP Rug Pull
Confidence: 87% confidence
Finding: The README instructs users to run npx skills add anivar/zod-testing -g without pinning the package/tool version. Because npx resolves and executes code from the registry at install time, users may receive a newer or compromised release than the author originally tested, which creates a supply-chain risk even though the content here appears to be ordinary documentation.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 90% confidence
Finding: The full-URL install example still relies on npx skills add without a pinned version for the skills tool and does not pin the GitHub repository to an immutable commit. That means execution and fetched content can drift over time or be replaced if the upstream package or repository is compromised.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 84% confidence
Finding: This ecosystem entry advertises npx skills add anivar/jest-skill -g, which again executes an unpinned installer path. Even in a README link table, this normalizes running remote code without version constraints, exposing users to supply-chain compromise or unexpected behavior from future releases.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 84% confidence
Finding: The msw-skill install command uses npx skills add without version pinning, so users may execute whatever package version is current at install time. This is a common but real documentation-driven supply-chain risk, especially because readers may copy-paste the command directly.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 84% confidence
Finding: The redux-saga-testing entry repeats the same unpinned npx skills add pattern. Since npx can download and run packages dynamically, users are exposed to any malicious or breaking changes introduced upstream after the README was published.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 84% confidence
Finding: The zod-skill ecosystem command is another unpinned npx installation example, carrying the same risk of executing altered or compromised upstream code. The surrounding context is a developer skill README, so copy-paste execution by users is plausible and increases practical exposure.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 84% confidence
Finding: The redux-saga-skill install line documents execution through an unversioned npx skills command. While likely included for convenience rather than abuse, it still creates a supply-chain exposure because the exact code executed is not fixed.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 84% confidence
Finding: The contributor-codebase-analyzer entry also uses an unpinned npx skills add command, which can fetch and execute changing remote content. In this skill-distribution context, the issue is more dangerous than a passive reference because the README directly instructs execution of a remote installer.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill introduces child_process.execSync to run a shell grep command as part of testing guidance, which expands the skill from schema testing into arbitrary command execution. Even though the command string is static in the example, normalizing shell execution in docs increases the chance that users adapt it with variable input or run it in sensitive CI environments, creating command-injection and environment-abuse risk.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Vague Triggers

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The manifest says the skill triggers on 'test files for Zod schemas' and 'schema testing patterns,' which are not tightly bounded and do not include exclusion conditions or negative examples. Those phrases could cause unintended invocation in broadly relevant testing contexts beyond the intended scope.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

Category: Not specified by scanner
Confidence: 78% confidence
Finding: The manifest emphasizes Zod testing patterns, including snapshot testing with toJSONSchema(), but this section expands into filesystem mutation and CI git-diff workflow automation. While related, exporting files and enforcing CI repository state are broader operational capabilities not clearly justified by the stated purpose of a testing-pattern skill.
Content: No source excerpt is available for this finding.