NPkill

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 6:33 AM UTC
• Version: 1.0.1

Overview

This is a straightforward developer cleanup skill, with disclosed but real risks around bulk deletion and global package installation.

Install only if you are comfortable trusting npkill from your npm registry. Prefer dry-run and interactive mode, run from a narrow development workspace, and avoid --delete-all --yes unless you have reviewed the matched paths and can recreate the deleted folders.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:103
• Finding: Unpinned Global Installation of a Third-Party npm Package## Vulnerability Details **File Location**: `SKILL.md`, lines 103-106 **Vulnerability Type**: Unpinned third-party dependency installed globally **Risk Level**: Medium **Vulnerable Code Snippet**: ```markdown ## Installation Requirements This skill requires the npkill CLI tool to be installed globally: ```bash npm install -g npkill ``` ``` ### Technical Analysis The installation command does not specify an exact version, integrity hash, lockfile, or other provenance control. It therefore resolves the mutable latest version of `npkill` from the configured npm registry at installation time. npm installation can execute package lifecycle scripts, while the global installation option exposes the installed executable throughout the user's environment. If a future package release, transitive dependency, npm registry response, or configured registry is compromised, following this instruction could install and execute code that was not included in the reviewed Skill. The installed utility is subsequently trusted to scan directories and perform recursive deletion. Although no malicious behavior is present in the audited file itself, relying on an unpinned globally installed package creates a supply-chain risk. ### Attack Path 1. An attacker compromises a future `npkill` release, one of its transitive dependencies, or the npm registry configured on the victim's system. 2. The victim follows the documented `npm install -g npkill` instruction. 3. npm resolves and downloads the attacker-controlled package version because no exact version or integrity constraint is specified. 4. Malicious code executes through an installation lifecycle script or when the globally installed `npkill` command is invoked. 5. The code runs with the privileges of the user executing npm and can access resources available to that account. If installation is performed with administrative privileges, the resulting impact may be correspondingly greater. ...[truncated 513 chars]
• Remediation: ## Remediation Suggestions 1. Pin `npkill` to an explicitly reviewed version rather than installing the mutable latest release. 2. Record and verify the expected package integrity hash and trusted npm registry. 3. Prefer a project-local, lockfile-controlled dependency over global installation. 4. Install and execute the package without administrative privileges. 5. Review the pinned package, transitive dependency tree, and lifecycle scripts before use. 6. Retain the documented dry-run and interactive review steps before permitting deletion. 7. Periodically reassess the pinned version and update it only after security review.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

```bash
npkill --delete-all --yes
```
Automatically deletes all node_modules folders found. Use only after verifying with dry-run.

### View Sizes in Gigabytes
```bash

• Confidence: 91% confidence
• Finding: The skill explicitly presents a fully non-interactive destructive command (`npkill --delete-all --yes`) that enables autonomous bulk deletion of directories without per-item user confirmation. Although the stated purpose is workspace cleanup and the surrounding text advises caution and dry-run first, an agent following this skill could still remove large amounts of project state automatically, causing data loss or disruption if run from an overly broad directory or in an unexpected environment.

Static analysis

No suspicious patterns detected.