peak-setup

• Outcome: Review
• Latest audit: Sep 13, 2026 · 4:39 PM UTC
• Version: 1.0.0

Overview

This skill appears purpose-aligned, but it runs mutable remote npm packages and can upload workflow files to Peak without a clear approval step.

Review this skill before installing. It is not clearly malicious, but only run it in repositories where uploading selected GitHub Actions workflow files to Peak is acceptable, avoid exposing broad environment secrets, and prefer pinned or otherwise verified CLI versions before execution.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:29

Finding

Execution of Unpinned Remote npm Packages

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 29 and 62
Vulnerability Type: T03: Remote Payload Retrieval and Execution, T08: Insecure Dependencies
Risk Level: High

Complete Code Snippet:

text

npx -y @peakinc/init@latest --yes --json --no-browser

text

npx -y @peakinc/wizard@latest --yes --json --no-browser

Technical Analysis

The Skill instructs the agent to use npx to download and execute two npm packages selected through the mutable latest tag. The -y option suppresses the normal installation confirmation. Consequently, the code executed during a future Skill invocation may differ from the code available when the Skill was audited.

This creates both a remote payload execution risk and an insecure software supply-chain dependency. Compromise of the npm publisher account, package registry, package maintainers, or a future release could cause arbitrary attacker-controlled JavaScript to execute locally. No exact package version, package integrity hash, signature verification, or source review requirement is provided.

Attack Path

1. An attacker compromises the publisher account, release pipeline, or another component used to publish @peakinc/init or @peakinc/wizard.
2. The attacker publishes a malicious package version and assigns it to the latest distribution tag.
3. A user asks the agent to configure Peak for a repository.
4. Following SKILL.md, the agent executes the corresponding npx -y ...@latest command without an installation prompt.
5. npm retrieves and executes the attacker-controlled package under the agent process's current operating-system account.
6. The malicious package can access resources available to that account, including repository files, process environment variables, local Git configuration, and credentials exposed to the process.

Impact Assessment

Successful exploitation permits arbitrary code execution with the privil ...[truncated 590 chars]

Remediation

View remediation

Remediation Suggestions

• Replace each @latest reference with a reviewed, exact package version, such as @peakinc/init@X.Y.Z and @peakinc/wizard@X.Y.Z.
• Establish a controlled update process in which new versions are reviewed and tested before the pinned version is changed.
• Verify downloaded package integrity using a trusted lockfile, registry integrity metadata, signatures, or independently maintained checksums.
• Avoid suppressing installation confirmation with -y unless execution occurs in a controlled environment and the package version has already been approved.
• Require explicit user approval before downloading and executing a package for the first time.
• Run the CLI with least privilege in an isolated environment that exposes only the target repository and the minimum required credentials.
• Remove unrelated secrets from the child process environment and ensure sensitive credentials are narrowly scoped and short-lived.

other

Warning

• Location: SKILL.md:60

Finding

External Disclosure of Repository Workflow Files

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 60–65
Vulnerability Type: other: External Repository Data Disclosure
Risk Level: Medium

Complete Code Snippet:

text

## Hard jobs

The `plan` event lists jobs the CLI could not move under `manual`, with a `reason`. Matrix jobs with macOS or Windows legs, `runs-on` expressions, and runner label lists land here. For these, run the Peak agent instead:

npx -y @peakinc/wizard@latest --yes --json --no-browser

text

It does everything `init` does. For the hard jobs it sends only those workflow files to Peak over a secure connection. Peak decides per job and edits only the `runs-on` line and the matrix values.

Technical Analysis

The documented fallback sends affected GitHub Actions workflow files to the external Peak service. Workflow files may contain private repository metadata, internal action references, infrastructure endpoints, runner labels, organization conventions, or secrets that were improperly embedded directly in YAML.

Although the document states that transmission uses a secure connection, it does not specify the precise destination, authentication mechanism, retention period, deletion policy, access controls, redaction procedure, or whether explicit user authorization is obtained before upload. Encryption in transit protects the connection but does not eliminate disclosure to the receiving third party.

Attack Path

1. A repository contains a job that the initial CLI classifies as requiring manual handling.
2. The agent follows the fallback instructions and invokes @peakinc/wizard.
3. The wizard identifies workflow files associated with the unsupported jobs.
4. Those workflow files are transmitted to Peak for remote analysis.
5. Peak receives any sensitive configuration or accidentally embedded secret present in the transmitted files.
6. If the external service, its credentials, or its data handling controls are ...[truncated 786 chars]

Remediation

View remediation

Remediation Suggestions

• Require explicit, informed user approval before transmitting any repository file to Peak.
• Identify the exact workflow files that will be uploaded and show that list to the user before transmission.
• Scan selected files for hardcoded secrets, credentials, private keys, sensitive endpoints, and confidential metadata before upload.
• Redact unnecessary sensitive values and transmit only the minimum workflow fragments required to process unsupported runs-on expressions or matrix values.
• Document the receiving endpoint, encryption protocol, authentication controls, retention period, deletion mechanism, subprocessors, and service access controls.
• Provide a local-only fallback for repositories whose security or compliance policies prohibit third-party source upload.
• Ensure repository documentation prohibits embedding secrets directly in workflow files and requires GitHub Secrets or an equivalent protected secret store.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (4)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The skill executes a remote npm package with npx ...@latest, which fetches and runs whatever version is current at execution time. This creates a supply-chain risk: a compromised publisher account, malicious release, or breaking change could cause arbitrary code execution on the user's machine or repository context.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The wizard command also uses npx ...@latest, so the skill may execute unreviewed code retrieved at runtime. Because this fallback handles workflow files and may transmit repository content externally, an unexpected package update could introduce arbitrary code execution or broaden data exfiltration risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill states that hard-job workflow files are sent to Peak, but it does not require a clear upfront warning or explicit user consent in the skill description before that transfer occurs. Since CI workflow files can contain sensitive infrastructure details, this omission can lead to unintended disclosure of repository configuration to a third party.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The undo path still relies on npx ...@latest, so even a rollback action can execute newly published remote code. While the intended operation is narrower, it remains an unnecessary supply-chain execution point in a repository context.

Content

No source excerpt is available for this finding.