Security checks for vulnerabilities and agentic risk
Overview
This skill is a coherent API review checklist, with minor caution needed around broad activation triggers and an unpinned documentation command.
Install only if you want API review workflow guidance. Review when it activates because its trigger list is broad, and prefer a lockfile-backed local TypeDoc command instead of allowing npx to download typedoc during a review.
### Technical Analysis
The instruction invokes `npx typedoc` without requiring a locally installed, lockfile-pinned TypeDoc dependency or specifying an exact reviewed version. If TypeDoc is unavailable locally, `npx` may resolve and download a package from the configured package registry before executing it.
This creates a supply-chain execution boundary in which the effective code can change after the Skill has been audited. Dependency drift, registry compromise, package-account compromise, malicious registry configuration, or package-resolution manipulation could cause unreviewed code to run. Documentation generation is relevant to the Skill, but dynamic acquisition of executable code exceeds the minimum privilege necessary for API surface inventory.
### Attack Path
1. A user or Agent applies the TypeScript inventory workflow.
2. The environment does not contain a trusted local TypeDoc executable.
3. The Agent runs `npx typedoc` as instructed.
4. `npx` resolves the package using the environment's configured registry without an explicit version or local-only constraint.
5. A compromised, substituted, or unexpectedly changed package is downloaded.
6. Package installation lifecycle logic or the TypeDoc executable runs with the privileges and environment of the invoking process.
7. Malicious code can access resources available to that process.
### Impact Assessment
Successful exploitation could provide arbitrary code execution with the invoking user or Agent's privileges. The resulting code could read repository contents, environment variables, accessible credentials, and othe
...[truncated 355 chars]
Remediation
View remediation
Remediation Suggestions
Add TypeDoc as a reviewed development dependency pinned through the project's manifest and lockfile.
Prevent automatic network retrieval by invoking the existing local dependency with a command such as:
bash
npx --offline --no-install typedoc
Prefer a lockfile-backed package script, for example:
json
{
"scripts": {
"docs": "typedoc"
}
}
Then run it with the package manager's immutable or frozen-lockfile workflow.
Pin an exact reviewed TypeDoc version and retain package integrity metadata.
Require failure when the trusted local dependency is absent rather than allowing an implicit download.
Run documentation generation in a sandbox with minimal filesystem access, no unnecessary credentials, and restricted network access.
The trigger list includes broad terms such as "api," "design," "consistency," and "documentation," which are common in many unrelated developer conversations. This can cause the skill to activate outside its intended scope, leading to noisy or unintended workflow execution and potentially exposing repository context or influencing decisions when the user did not request an API review.
Content
No source excerpt is available for this finding.
Rp1
Medium
Category
MCP Rug Pull
Confidence
93% confidence
Finding
The skill instructs users to run npx typedoc without pinning a specific package version. npx may fetch and execute the latest published package from the registry, which creates a supply-chain risk if a malicious or compromised release is published or if behavior changes unexpectedly between runs. In this skill context, the command is part of normal documentation generation, so the intent appears benign, but the operational pattern still increases exposure.
