AIScan — AI Readiness Scanner

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:30 AM UTC
• Version: 2.0.0

Overview

The skill’s website-scanning purpose is clear, but it documents unsafe ways to run mutable remote code and apply remote fix guidance into user projects.

Install only if you are comfortable using AIScan as a third-party hosted scanner. Prefer the REST API or MCP scan tools, avoid the curl | node fallback, pin any CLI version before running it, and review every proposed repository change before accepting it, especially fixes returned from the remote service.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:169
• Finding: Mutable Remote JavaScript Is Downloaded and Executed Without Verification<: npx aiscan-cli <url> - zero-install terminal scanner (also published as @aiscan/cli; npm i -g aiscan-cli for the short "aiscan" command) with JSON/Markdown output, CI gates and agent fix prompts - [CLI script](https://aiscan.site/cli.mjs): fallback for environments without npm, curl -fsSL https://aiscan.site/cli.mjs | node - example.com ``` ### Technical Analysis The documented shell pipeline downloads JavaScript from a live HTTPS endpoint and immediately passes it to Node.js. The downloaded payload is not pinned to a version and is not checked using a cryptographic digest or trusted signature. It is also not saved for inspection before execution. Consequently, the effective code executed by the Skill user can change after the package has been reviewed. HTTPS protects the connection in transit but does not protect against compromise of the source domain, DNS, hosting account, deployment pipeline, or maintainers' credentials. This behavior is not necessary for the declared website-scanning functionality because the Skill already documents a REST API that can be invoked using `curl` without executing downloaded code. ### Attack Path 1. An attacker compromises `aiscan.site`, its deployment pipeline, DNS configuration, or the account controlling `cli.mjs`. 2. The attacker replaces the JavaScript resource with a malicious payload. 3. An agent or user follows the documented fallback command. 4. `curl` retrieves the attacker's current payload. 5. The shell pipes the response direc ...[truncated 1087 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the `curl | node` command from all documentation and reference assets. 2. Prefer the existing REST API workflow, which only transmits a target URL and parses data rather than executing remote code. 3. If a CLI is required, distribute a reviewed, versioned artifact from a controlled release channel. 4. Publish a SHA-256 digest or signed release manifest and require verification before execution. 5. Download the artifact to a local file first, verify its integrity and provenance, and present it for review before running it. 6. Use an immutable versioned URL rather than a mutable path such as `/cli.mjs`. 7. Run any downloaded CLI in a restricted environment with minimal filesystem access, no unnecessary credentials, and limited outbound networking. 8. Keep bundled reference documentation consistent so the unsafe fallback is not reintroduced from `assets/llms.txt`. ]]>

T08 · Insecure Dependencies

Error

• Location: SKILL.md:161
• Finding: Unpinned npm Package Is Fetched and Executed Through npx<: npx aiscan-cli <url> - zero-install terminal scanner (also published as @aiscan/cli; npm i -g aiscan-cli for the short "aiscan" command) with JSON/Markdown output, CI gates and agent fix prompts ``` ### Technical Analysis The `npx aiscan-cli` commands do not specify an exact package version or integrity value. If the package is not already installed locally, `npx` may resolve and execute code obtained from the configured npm registry. This creates a supply-chain execution boundary controlled by the current registry state rather than by the audited Skill package. A compromised package release, maintainer account, registry dependency, or transitive dependency could therefore execute code locally. The reference to both the unscoped `aiscan-cli` name and the scoped `@aiscan/cli` name also introduces avoidable package-identity ambiguity. The `--fix` mode is particularly sensitive because the package is expected to modify files, making malicious changes po ...[truncated 1518 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace unversioned commands with an exact, reviewed package version. 2. Clearly identify one canonical package name and remove ambiguity between `aiscan-cli` and `@aiscan/cli`. 3. Maintain a lockfile with registry integrity metadata when the CLI is used as a project dependency. 4. Prefer installing the reviewed package explicitly before execution rather than relying on `npx` auto-install behavior. 5. Use `npx --no-install` after a trusted version has been installed locally. 6. Disable package lifecycle scripts where operationally possible. 7. Verify package provenance, signatures, maintainer ownership, and published-file contents before updating versions. 8. Execute the CLI in a sandbox with only the minimum required repository access and without unrelated credentials. 9. Require a diff review and explicit approval before accepting changes produced by `--fix`. 10. Update every duplicated command in `SKILL.md`, `README.md`, `assets/CLAUDE.md`, and `assets/llms.txt`. ]]>

T03 · Remote Payload Retrieval and Execution

Error

• Location: assets/aiscan-skill.json:17
• Finding: Hosted API Responses Can Direct Agents to Apply Remote Code to User Repositories<![CDATA[ ## Vulnerability Details **File Location**: `assets/aiscan-skill.json:17-20`; related instructions in `SKILL.md:119-125`, `README.md:109-116`, and `assets/CLAUDE.md:69-80` **Vulnerability Type**: Remotely controlled code and repository modification **Risk Level**: High ### Vulnerable Code `assets/aiscan-skill.json:17-20`: ```json "Step 3 — Iterate `checks[]`. Focus on entries where `status` is `fail` or `partial`. Each has an `id`, `name`, `dimension`, `tier` (essential | recommended | bonus), human `remediation` text, `specs` citing the standards measured, and an optional `fixGuide` array of concrete steps (with `title`, `body`, `code`, `lang`).", "Step 4 — Apply each fix to the user's codebase. Match the platform: for Next.js/TanStack edit `public/robots.txt`, `public/llms.txt`, sitemap routes, `.well-known/*` files. For WordPress recommend a plugin or `functions.php` snippet. Keep changes minimal and idiomatic to the stack.", "Step 5 — After applying fixes, call the scan endpoint again on the same URL and report the new score so the user can see the delta. Do not re-scan more than 5 times per minute (anonymous rate limit). If the response has `cached: true`, retry with `fresh: true` after the fixes are deployed.", "Important — Never invent check ids or fixes. Use only the `remediation` and `fixGuide` returned by the API. If a check has `status: \"na\"` skip it — it doesn't apply to this site type (read `naReason`). Bonus-tier checks can only add points; essential-tier failures cost the most." ``` `assets/CLAUDE.md:69-80`: ```text 3. For each failing check: - Read `remediation` for the plain-English summary and `specs` for the standards it is measured against. - If `fixGuide` is present, follow its ordered steps. Each step may have `code` + `lang` — apply that code to the matching file in the user's repo. - Match the file to the detected `platform`: - **TanStack/Next.js/Vite app** — edit `public/robots.txt`, `public/llms.txt`, site ...[truncated 3775 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Explicitly classify every API response field, including `remediation`, `fixGuide.body`, and `fixGuide.code`, as untrusted external data. 2. Never execute remote commands or apply returned code verbatim. 3. Convert remediation responses into advisory input and independently generate minimal changes from trusted local templates. 4. Define a strict schema and allowlist for supported file types, operations, and content. 5. Reject fixes that add shell commands, package-installation steps, lifecycle hooks, external scripts, encoded content, credential access, or unrelated network endpoints. 6. Display the proposed patch and require explicit user approval before each repository modification. 7. Run static analysis, secret scanning, dependency review, and project tests before accepting a patch. 8. Restrict the agent to the minimum repository paths needed for the requested remediation. 9. Require separate approval before deployment or other external changes. 10. Preserve an auditable diff and provide a rollback procedure. 11. Do not state that the live service is unconditionally authoritative for executable or repository-changing content. 12. Align `SKILL.md`, `README.md`, `assets/CLAUDE.md`, and `assets/aiscan-skill.json` with the same trust-boundary requirements. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (17)

External Script Fetching

High

• Category: Supply Chain

Content

Use `--page` with an API key for a Pro single-page scan. The no-install fallback is:

```bash
curl -fsSL https://aiscan.site/cli.mjs | node - example.com
```

## MCP Usage

• Confidence: 98% confidence
• Finding: `curl -fsSL https://aiscan.site/cli.mjs | node - example.com` fetches remote code over the network and immediately executes it, which is a classic arbitrary code execution pattern. If the server, DNS, TLS termination, or delivery path is compromised, or if the file changes unexpectedly, users and agents could run attacker-controlled JavaScript locally.

External Script Fetching

High

• Category: Supply Chain

Content

## Tools & APIs
- [AIScan on ClaWHub](https://clawhub.ai/asif2bd/skills/aiscan-ai-readiness-scanner): Agent skill marketplace listing — install directly into Claude, Cursor, or any skill-aware runtime
- [CLI](https://aiscan.site/docs/cli): npx aiscan-cli <url> - zero-install terminal scanner (also published as @aiscan/cli; npm i -g aiscan-cli for the short "aiscan" command) with JSON/Markdown output, CI gates and agent fix prompts
- [CLI script](https://aiscan.site/cli.mjs): fallback for environments without npm, curl -fsSL https://aiscan.site/cli.mjs | node - example.com
- [MCP Endpoint](https://aiscan.site/api/mcp): Machine-readable scan and blog publish endpoint
- [Stable REST API v1](https://aiscan.site/api/public/v1/scan): GET/POST ?url=... - returns the full scan JSON; RFC 9457 problem+json on error
- [OpenAPI 3.1](https://aiscan.site/openapi.json): Machine-readable description of every public endpoint

• Confidence: 97% confidence
• Finding: The documentation recommends `curl -fsSL https://aiscan.site/cli.mjs | node`, which executes remote code fetched at runtime with no integrity verification. If the hosting origin, DNS, TLS termination, or upstream asset pipeline is compromised, users could immediately run attacker-controlled code, making this a classic high-risk supply-chain and remote code execution pattern.

External Transmission

Medium

• Category: Data Exfiltration

Content

Or call the API directly:

```bash
curl -sS -X POST https://aiscan.site/api/public/v1/scan \
  -H 'Content-Type: application/json' \
  -d '{"url":"https://example.com"}'
```

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

Or call the API directly:

```bash
curl -sS -X POST https://aiscan.site/api/public/v1/scan \
  -H 'Content-Type: application/json' \
  -d '{"url":"https://example.com"}'
```

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 89% confidence
• Finding: The skill instructs use of `npx aiscan-cli` without pinning a specific package version. That allows whatever version is current at execution time to be fetched and run, creating a supply-chain risk if a future release is compromised or introduces unsafe behavior.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 89% confidence
• Finding: This line again recommends running `npx aiscan-cli` without a pinned version, so the user may execute an unreviewed future package release. In agent workflows, that is especially risky because package resolution and execution may happen automatically with little scrutiny.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 89% confidence
• Finding: Using unpinned `npx aiscan-cli` for CI score gates exposes CI runners to execution of a mutable package from the registry. A compromised or malicious update could execute arbitrary code in the CI environment and access repository secrets or tokens.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 89% confidence
• Finding: This example also invokes `npx aiscan-cli` without version pinning, preserving the same supply-chain risk across another execution path. Because the skill targets automation, users may copy these commands into unattended systems where package drift becomes harder to detect.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill instructs sending user-supplied website URLs to a third-party service without an explicit privacy or data-sharing warning to the user. Even if the submitted data is only a URL, it can disclose sensitive internal, staging, customer-specific, or non-public endpoints to the external provider and may trigger scanning of resources the user did not intend to share broadly.

External Transmission

Medium

• Category: Data Exfiltration

Content

Stable endpoint: `https://aiscan.site/api/public/v1/scan` (the legacy `/api/public/scan` accepts the same parameters and is still supported).

```bash
curl -X POST https://aiscan.site/api/public/v1/scan \
  -H 'Content-Type: application/json' \
  -d '{"url":"https://example.com"}'
```

• Confidence: 94% confidence
• Finding: This content directly instructs transmitting user-provided input to an external API endpoint. In the context of an agent skill, that is security-relevant because users may provide confidential URLs, internal hosts, or staging systems, and the skill contains no guardrails requiring validation, warning, or confirmation before disclosure to the third party.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill documents an `isPublic` request parameter that can override report visibility, but it provides no warning to obtain user consent or explain the privacy implications. In a scanning skill, reports may contain sensitive URLs, platform fingerprints, commerce signals, or other site metadata; exposing them publicly by default or without an explicit confirmation can leak information unintentionally.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Description-Behavior Mismatch

Medium

• Confidence: 84% confidence
• Finding: The llms.txt advertises that the MCP endpoint can perform both scans and blog publishing, which exceeds the stated website-auditing purpose of the skill. Capability mismatch is dangerous because agents or users may grant broader trust or permissions than intended, increasing the chance of unintended content publication or misuse of write-capable actions.

Static analysis

No suspicious patterns detected.