Search Tasks

• Outcome: Review
• Latest audit: Sep 11, 2026 · 2:39 AM UTC
• Version: 0.1.1

Overview

The skill is for read-only OpenAnt task browsing, but it authorizes automatic execution of an unpinned npm package every time it runs.

Review this skill before installing. Its OpenAnt task queries are read-only, but the skill runs a live npm package through npx @latest without pinning or integrity verification and tells the agent to run it without confirmation. Prefer a version pinned to a reviewed release, tighter OpenAnt-specific invocation wording, and sandboxed execution with only the credentials and files needed for OpenAnt task browsing.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:6

Finding

Unpinned npm Package Is Downloaded and Executed via npx

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 6-18; additional occurrences at lines 25, 55, 62, 80, and 100
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code

yaml

allowed-tools: ["Bash(npx @openant-ai/cli@latest status*)", "Bash(npx @openant-ai/cli@latest tasks list *)", "Bash(npx @openant-ai/cli@latest tasks get *)", "Bash(npx @openant-ai/cli@latest tasks escrow *)"]

markdown

Use the `npx @openant-ai/cli@latest` CLI to browse, filter, and inspect tasks on the platform. No write operations — all commands here are read-only.

**Always append `--json`** to every command for structured, parseable output.

## Confirm Authentication

```bash
npx @openant-ai/cli@latest status --json

text

Further affected commands include:

```bash
npx @openant-ai/cli@latest tasks list [options] --json
npx @openant-ai/cli@latest tasks get <taskId> --json
npx @openant-ai/cli@latest tasks escrow <taskId> --json
npx @openant-ai/cli@latest stats --json

Technical Analysis

The skill consistently invokes npx @openant-ai/cli@latest. The latest tag is mutable and does not identify a fixed, previously audited artifact. Depending on the local npm cache and configuration, npx may retrieve the current package release and its transitive dependencies from the npm registry before executing it.

Although the skill describes these commands as read-only queries, that restriction applies only to the CLI's intended application-level operations. It does not constrain code in the downloaded npm package, its dependencies, or applicable package lifecycle behavior. A compromised publisher account, malicious release, or compromised transitive dependency could therefore cause arbitrary code to execute with the permissions of the agent process.

The command recommended at line 100 also invokes tasks stats, which is not covered by the declared allowed-tools patterns. This is a configuration inconsistency, a ...[truncated 1590 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace @latest with an exact, reviewed version in every command, for example:

   bash

   npx --yes @openant-ai/cli@1.2.3 status --json
   

2. Review the selected release and its transitive dependency tree before approving it. Repeat that review before changing the pinned version.

3. Prefer a locked installation with integrity verification over dynamic execution. Commit an appropriate lockfile and use a deterministic installation process such as npm ci.

4. Where operationally practical, configure npm to ignore lifecycle scripts and ensure packages are obtained only from an approved registry. This reduces, but does not eliminate, package execution risk.

5. Execute the CLI in a sandbox with least privilege:

   • Restrict filesystem access.
   • Expose only required environment variables.
   • Avoid passing unrelated credentials into the process.
   • Limit outbound network access to required OpenAnt endpoints and approved package infrastructure.

6. Update every documented invocation consistently; leaving even one @latest occurrence preserves the supply-chain risk.

7. Add the documented stats operation to the allowlist only if it is intentionally supported and reviewed. Otherwise, remove that recommendation so the documentation and enforced capabilities remain aligned.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (15)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 99% confidence

Finding

The manifest allowed-tools permits Bash(npx @openant-ai/cli@latest ...), which authorizes execution of an unpinned remote package as part of the skill boundary itself. This is more dangerous than documentation alone because the runtime policy explicitly allows the unsafe command pattern.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The invocation description contains broad trigger phrases like 'find tasks', 'show me open tasks', and 'search for work', which can overlap with common user requests and cause the skill to auto-trigger more often than intended. In this skill, overbroad invocation increases exposure to the unpinned npx @latest execution path, amplifying the supply-chain risk and potentially causing unnecessary external queries.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

The skill repeatedly invokes npx @openant-ai/cli@latest, which is an unpinned moving target. Because npx fetches and executes the latest published package version at runtime, a compromised upstream package, malicious maintainer update, or dependency hijack could lead to arbitrary code execution in the agent environment.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

This command uses npx ...@latest for the authentication status check, so even a supposedly read-only operation first requires executing untrusted remote package code. If the package is tampered with upstream, the attacker gains execution before any task-query logic occurs.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

The task browsing command is documented with npx @openant-ai/cli@latest, which creates a supply-chain execution risk every time the skill is used. The danger is elevated because this skill is user-invocable and intended for immediate execution, increasing the frequency and likelihood of exposure.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

Example commands normalize the use of @latest, encouraging downstream agents or operators to execute whatever package version is current at runtime. That makes behavior non-reproducible and opens the door to malicious updates or dependency compromise resulting in code execution.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

This tasks get usage executes a latest-fetched package from the registry, so the risk is not limited to task data exposure; it can become arbitrary command execution in the host context. Because the skill claims operations are read-only, users may underestimate the execution risk and run it without scrutiny.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The repeated @latest reference continues the same supply-chain risk pattern: an attacker controlling the package or its dependencies can alter command behavior at any future invocation. The read-only business purpose does not mitigate the fact that arbitrary JavaScript/package lifecycle code may run first.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

This instance also relies on npx ...@latest, preserving a silent trust dependency on the public npm registry at runtime. A malicious package update could steal credentials, alter outputs, or execute arbitrary code under the agent's privileges.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

By embedding @latest in examples, the skill operationalizes unsafe package execution as standard usage. In an agent setting, this can be exploited to compromise the environment or falsify task-related results if the package supply chain is compromised.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

This example command has the same unpinned runtime package execution issue. Because agents may copy examples directly into tool invocations, each occurrence materially contributes to unsafe execution patterns rather than being merely stylistic duplication.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

Using @latest in paginated browsing examples still exposes the host to arbitrary upstream code changes on every run. The skill context makes this more dangerous because the commands are intended for routine, low-friction execution without user confirmation.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

The detailed task inspection command also executes a non-deterministic package version from npm. If compromised, it could exfiltrate environment secrets, tamper with JSON output, or pivot into the broader agent runtime.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

The escrow-status command is framed as an on-chain read, but it still depends on executing @latest package code fetched at runtime. That mismatch between apparent harmlessness and actual code-execution risk can lead to unsafe trust and widespread use.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

Even the error-handling guidance references npx ...@latest, extending the same supply-chain risk into recovery paths. Attackers often target such broadly copied snippets because they are likely to be executed verbatim by users and agents.

Content

No source excerpt is available for this finding.