Dependency Tracker

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 4:58 AM UTC
• Version: 1.0.1

Overview

This skill checks Node/npm dependency status and sends a report to Feishu, with the main privacy consideration being that package inventory is shared externally.

Install only if you are comfortable with Node/npm versions, global npm package names and versions, and project dependency update information being written to a local report and sent to the configured Feishu recipient. Configure and verify the Feishu target before use, and consider avoiding global package reporting if project-only dependency tracking is enough.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (2)

other

Warning

• Location: SKILL.md:22
• Finding: External Disclosure of Host-Level Package Inventory## Vulnerability Details **File Location**: `SKILL.md:22-31` **Vulnerability Type**: Environment Information Disclosure **Risk Level**: Medium **Complete Code Snippet**: ```markdown ## Delivery Rules (Mandatory) After completing the report, send it through the messaging tool. - Channel: feishu - Target: <Feishu group ID or user ID> If the report exceeds 3,800 characters, split it into multiple messages. Each message must remain semantically complete without breaking URLs or formatting. If delivery fails, retry once. If it still fails, output an error—never exit silently. ``` The original instructions are written in Chinese; this is a faithful English translation. ### Technical Analysis The skill mandates transmission of the generated report to an external Feishu destination. The report includes Node.js and npm versions, globally installed npm packages, and project dependency update information. In particular, `references/spec.md:7-10` directs the agent to run `npm list -g --depth=0`, causing collection to extend beyond the current project into host-level software inventory. Software names and exact versions are useful reconnaissance data because they can disclose installed administrative or development tooling and identify components with known vulnerabilities. The destination remains a placeholder, and the instructions do not require validation of the resolved recipient, explicit user approval, redaction, or an allowlist before disclosure. ### Attack Path 1. An operator or scheduled invocation activates the dependency-tracker skill. 2. The agent executes the documented environment checks, including `npm list -g --depth=0`. 3. The resulting report records runtime versions and globally installed package names and versions. 4. The skill resolves the configured Feishu group or user target without requiring destination verification or user confirmation. 5. The report is transmitted to that recipient, exposi ...[truncated 688 chars]
• Remediation: ## Remediation Suggestions 1. Keep generated reports local by default and make external delivery explicitly opt-in. 2. Display the resolved Feishu channel and recipient and obtain user confirmation before sending. 3. Require an allowlisted, validated destination rather than accepting an unchecked placeholder or arbitrary identifier. 4. Limit routine collection to dependencies in the current project. 5. Make global package enumeration a separate opt-in operation with a documented justification. 6. Redact exact host-level package versions unless they are essential to the approved task. 7. Apply least-privilege access controls to local reports and the Feishu destination. 8. Record delivery destination and authorization decisions in an audit log without storing credentials or message tokens.

other

Warning

• Location: references/spec.md:7
• Finding: Unnecessarily Broad Enumeration of Globally Installed npm Packages## Vulnerability Details **File Location**: `references/spec.md:7-10` **Vulnerability Type**: Environment Information Disclosure **Risk Level**: Medium **Complete Code Snippet**: ```markdown | Check | Command | |--------|---------| | Node.js version | `node -v` | | npm version | `npm -v` | | Global package list | `npm list -g --depth=0` | | Outdated packages | `npm outdated` | ``` The original table labels are written in Chinese; this is a faithful English translation. The commands are reproduced verbatim. ### Technical Analysis The command `npm list -g --depth=0` enumerates packages installed globally for the npm environment accessible to the executing account. This is broader than a project dependency update check and exposes host-level tooling that is not necessarily relevant to the project. The collected inventory is incorporated into the report format and, under `SKILL.md:22-31`, is subsequently sent to Feishu. Although the command is read-only and does not itself escalate privileges, combining broad host enumeration with mandatory external delivery creates an information-disclosure path. ### Attack Path 1. Trigger the skill manually or through its suggested weekly invocation. 2. The agent runs `npm list -g --depth=0` under its existing account privileges. 3. npm returns globally visible package names and versions. 4. The agent places those results into the dependency report. 5. The delivery workflow sends the report to the configured Feishu destination. 6. The recipient analyzes disclosed versions to profile the host and identify potentially vulnerable or security-sensitive tooling. ### Impact Assessment The command does not provide privileges beyond those already held by the executing account. The affected scope includes all globally installed npm packages visible in that account's npm prefix, rather than only dependencies belonging to the audited project. Disclosure can reveal platform capabiliti ...[truncated 73 chars]
• Remediation: ## Remediation Suggestions 1. Remove global package enumeration from the default workflow. 2. Use project-scoped commands, such as `npm outdated` in a validated project directory, for normal dependency tracking. 3. If global inventory is genuinely required, request explicit approval and explain which information will be collected and transmitted. 4. Filter the inventory to an approved package allowlist and omit unrelated tools. 5. Minimize version precision where exact versions are unnecessary. 6. Do not transmit global inventory externally unless the recipient has been validated and the user has approved disclosure.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (4)

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill mandates sending the generated dependency report to Feishu, but it does not disclose to the user that report contents will be transmitted to an external messaging service. Dependency reports can include package names, versions, environment details, and potentially sensitive operational metadata, so silent exfiltration to a third party creates a real privacy and security risk.

Natural-Language Policy Violations

Medium

• Confidence: 90% confidence
• Finding: The file title and all instructional content are presented in Chinese, which may force a specific language for users or maintainers without opt-in. The policy allows locale constraints only when user choice is offered or the restriction is clearly justified, neither of which appears here.

Natural-Language Policy Violations

Low

• Confidence: 84% confidence
• Finding: The skill instructions and operational description are presented entirely in Chinese, which can effectively force a specific language experience on users. The file does not offer a language choice or document that the locale restriction is intentional and justified.

Missing User Warnings

Low

• Confidence: 82% confidence
• Finding: This markdown file instructs the skill to execute shell commands and perform atomic writes to an output file, which can affect the user's system and filesystem. The spec does not include any warning or disclosure to the user about these behaviors, which is expected for markdown files under the missing user warnings rule.

Static analysis

No suspicious patterns detected.