Security audit

Innovation Catalyst

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly behaves like a local suggestion tool, but its package metadata includes an unnecessary npm dependency flagged as malicious and its Feishu reporting scope is not clearly bounded.

Review this skill before installing. The local script itself appears limited to printing innovation suggestions, but the package dependencies should be cleaned up before npm install, and any Feishu reporting should be explicitly scoped and approved because it may transmit workspace or system-state information externally.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Known Vulnerable Dependency: fs==0.0.1-security — 1 advisory(ies): MAL-2025-21003 (Malicious code in fs (npm))

High

Category: Supply Chain
Confidence: 99% confidence
Finding: The lockfile pins the package fs@0.0.1-security, and the provided advisory identifies it as a malicious npm package. A malicious dependency in the supply chain can execute attacker-controlled code during install or runtime, potentially leading to credential theft, file tampering, or arbitrary code execution in environments that build or run this skill.
Content: No source excerpt is available for this finding.

Known Vulnerable Dependency: fs==0.0.1-security — 1 advisory(ies): MAL-2025-21003 (Malicious code in fs (npm))

High

Category: Supply Chain
Confidence: 99% confidence
Finding: The dependency list includes fs==0.0.1-security, which the static analysis identifies as having a malicious-code advisory (MAL-2025-21003). Declaring a known malicious npm package is dangerous because package installation or execution can introduce attacker-controlled code into the environment, potentially enabling code execution, data access, or further compromise. In this skill context, the package is not necessary because Node.js already provides a built-in fs module, which makes the inclusion more suspicious rather than justified.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill explicitly states it sends a rich Feishu card report and also describes analyzing system state, memory, tools, and events. Without any warning, consent, scoping, or data-minimization language, this creates a real risk of exfiltrating potentially sensitive system-derived information to an external service. In this context, the danger is elevated because the inputs are broad internal state sources rather than narrowly defined user-provided content.
Content: No source excerpt is available for this finding.