propagate

• Outcome: Pass
• Latest audit: Sep 5, 2026 · 6:33 PM UTC
• Version: 1.0.0

Overview

This is an instruction-only workflow skill that keeps authority scoped to proposals unless the user approves exact actions.

Install only through a host or CLI you trust, and treat the skill as a planning aid unless you separately approve exact copy, commit, publish, deploy, or infrastructure actions.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: README.md:20
• Finding: Unpinned Third-Party CLI Execution During Installation## Vulnerability Details **File Location**: `README.md`, lines 20–22 **Vulnerability Type**: Unpinned third-party dependency execution **Risk Level**: Medium **Vulnerable code:** ```sh npx skills add AntreasAntoniou/propagate --skill propagate ``` ### Technical Analysis The documented installation command invokes the npm package named `skills` through `npx` without specifying a version or integrity value. If the package is not already available locally, `npx` may retrieve and execute its currently resolved version from the configured npm registry. Consequently, the code executed during installation is not fixed to the version reviewed with this project. Changes to the package, compromise of its publisher or distribution channel, or resolution from an unsafe registry could cause the command to execute unexpected code. The repository's security policy does not document package provenance, a trusted version, or integrity verification for this installer. ### Attack Path 1. An attacker compromises the publisher account, package release process, registry path, or another component controlling resolution of the unpinned `skills` package. 2. The attacker publishes a malicious version under the package name resolved by `npx`. 3. A user follows the installation command from `README.md`. 4. `npx` downloads the currently resolved malicious package because no trusted version or digest is pinned. 5. The package executes in the user's environment with the privileges and accessible resources of that user. ### Impact Assessment A malicious installer could execute arbitrary commands with the installing user's privileges. Depending on the installation environment, this could expose files and credentials accessible to that account, alter local repositories or Agent configuration, install additional components, or compromise the host environment. The audited Skill package itself contains no executable runtime, embedded malicious code, pers ...[truncated 115 chars]
• Remediation: ## Remediation Suggestions - Pin the installer to a reviewed, trusted version, for example by invoking an exact package version rather than the latest registry-resolved release. - Document the expected npm registry, package publisher, and verified package identity. - Where supported, verify the package using an integrity digest, signed provenance, or an equivalent trusted-release mechanism. - Recommend installing and auditing the CLI separately before using it to modify the Agent's skills directory. - Pin the alternative Git installation method to a signed release tag or verified commit so installed instructions correspond to the reviewed version. - Update release documentation whenever the verified installer version or integrity information changes.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Scope Creep

Low

• Category: Excessive Agency

Content

copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,

• Confidence: 70% confidence
• Finding: Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.