dora-metrics

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 9:43 AM UTC
• Version: 1.9.19

Overview

This skill is a disclosed DORA metrics helper with some install and trigger caution, but no evidence of hidden, destructive, or deceptive behavior.

Before installing, be aware that the skill may activate on broad engineering terms and that optional charting asks you to install a third-party Cargo package without a pinned version. Use it only on repositories where reading git history and GitHub issue or PR labels is appropriate, and pin or review external tools before installing them.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:76

Finding

Unpinned Third-Party Package Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 76–82
Vulnerability Type: Unpinned third-party dependency installation
Risk Level: Medium

Vulnerable Code Snippet:

markdown

   kuva reads TSV/CSV from stdin or a file path. Install once:
   `cargo install kuva --features cli`. No project source changes
   required. See [kuva](https://github.com/Psy-Fer/kuva) for the
   full plot-type reference.

Technical Analysis

The skill recommends installing kuva from the Cargo package registry without specifying an exact reviewed version or requiring dependency-lock enforcement. The command therefore resolves a mutable package release and its transitive dependency graph at installation time.

Cargo package installation may compile and execute package build scripts or proc-macro dependencies. Consequently, the effective code trusted by a user can differ from the code available when this skill was audited. A compromised upstream crate, malicious newly published release, or compromised transitive dependency could introduce attacker-controlled code into the installation process.

This is a supply-chain weakness. The audit did not establish that the current kuva package is malicious; the vulnerability is that the documented installation procedure does not constrain or verify the code that users will receive.

Attack Path

1. An attacker compromises the kuva crate, its publishing account, or a transitive dependency, and publishes a malicious release.
2. A user or agent follows the instruction in SKILL.md and runs:

   bash

   cargo install kuva --features cli
   

3. Cargo selects the current package version and resolves dependencies without an exact reviewed version requirement.
4. Cargo downloads and compiles the attacker-controlled package or dependency.
5. Malicious build-time or runtime code executes with the privileges of the user performing the installation.

Impact Ass

...[truncated 659 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin kuva to an exact version that has been reviewed:

   bash

   cargo install kuva --version '<exact-reviewed-version>' --locked --features cli
   

2. Retain --locked so Cargo uses the package's published lockfile where supported, reducing unexpected transitive dependency changes.
3. Document the expected registry, upstream repository, reviewed version, and package checksum or other integrity-verification information.
4. Make installation explicitly optional and require user confirmation before downloading or executing third-party package code.
5. Periodically review the pinned package and its transitive dependencies before updating the documented version.
6. Prefer running the tool in a constrained environment with access limited to the chart input and intended output directory.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest defines several broad triggers such as "dora", "metrics", "delivery", and "github" that are common terms in normal engineering conversations. This can cause the skill to activate unexpectedly in unrelated contexts, increasing the chance that repository analysis or GitHub-oriented guidance is invoked without clear user intent. The skill content itself is not overtly dangerous, so the main risk is accidental invocation rather than direct compromise.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.