propagate

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 11:30 AM UTC
• Version: 1.0.0

Overview

This is an instruction-only planning skill with clear approval boundaries; the main caution is its unpinned npx installation example.

Before installing, prefer a trusted, already-approved skills CLI or pin/verify the installer source and version; once installed, use the skill as a proposal workflow and approve only exact repositories, paths, and actions you intend it to touch.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: README.md:19

Finding

Unpinned npm CLI Execution in Installation Instructions

Content

View full analysis

Vulnerability Details

File Location: README.md, lines 19-23
Vulnerability Type: Supply-chain risk caused by executing an unpinned third-party package
Risk Level: Medium

Code Snippet:

markdown

With the Agent Skills CLI:

```sh
npx skills add AntreasAntoniou/propagate --skill propagate

text

### Technical Analysis

The documented installation command invokes `npx` with the mutable package identifier `skills` and does not specify a reviewed version or integrity value. Depending on the local npm configuration and cache state, `npx` may download and execute the package currently resolved by the configured npm registry.

The audited repository does not contain the CLI implementation, a lockfile governing this command, or an integrity digest that establishes which external code will execute. Consequently, the effective installation code can change independently of this repository after the documentation has been reviewed.

This is a supply-chain exposure rather than evidence that the current package is malicious. Exploitation requires the resolved package, one of its dependencies, its distribution channel, or the configured registry to be compromised or replaced.

### Attack Path

1. An attacker compromises the package resolved as `skills`, one of its transitive dependencies, a maintainer account, or an npm registry used by the victim.
2. The attacker publishes or serves a malicious version containing executable installation or runtime behavior.
3. A user follows the documented `npx skills add AntreasAntoniou/propagate --skill propagate` instruction.
4. `npx` retrieves the mutable package version from the configured registry and executes it.
5. The malicious process runs with the privileges and environmental access of the invoking user.

### Impact Assessment

Successful exploitation could execute arbitrary code under the installing user's account. The resulting scope could include reading or modi
...[truncated 423 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the installation CLI to a specifically reviewed version rather than relying on the registry's current resolution, for example by documenting an explicit package@version reference.
• Verify and document the package's authoritative publisher and source repository so users can distinguish it from similarly named or spoofed packages.
• Provide integrity verification or a trusted lockfile-based installation workflow where the package manager and distribution process support it.
• Recommend using an already-installed, organization-approved CLI in managed environments instead of downloading executable code at invocation time.
• Document review and update procedures for the pinned CLI version and its transitive dependencies.
• Retain the direct repository clone method as a non-executing download alternative, while advising users to inspect the retrieved contents and pin a commit or release tag before loading the skill.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.