T08 · Insecure Dependencies
Warning
- Location
SKILL.md:77- Finding
Unpinned GitNexus Package Execution Through npx
- Content
View full analysis
- Remediation
View remediation
Security audit
Code Graph（代码图谱）
Security checks for vulnerabilities and agentic risk
Overview
The skill is purpose-aligned for setting up GitNexus, but it includes risky fallback and troubleshooting commands that can execute unpinned packages and commit all local files.
Review before installing. Prefer the pinned global install path or an explicitly pinned `npx gitnexus@1.6.5` command, and avoid the suggested `git add . && git commit` workflow unless you have reviewed `.gitignore`, checked `git status`, and confirmed no secrets or private files will be committed.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:188- Finding
Unrestricted Staging and Committing of Project Files
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (10)
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The troubleshooting instructions suggest
git init && git add . && git commitwithout warning that this stages and records all current files, potentially including secrets, credentials, build artifacts, or proprietary data. In the context of a setup skill, users may not expect a version-control action that permanently snapshots their working directory.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The manifest description defines invocation phrases only in Chinese, which imposes a specific language requirement without indicating user opt-in or multilingual alternatives. This is a natural-language policy issue because the skill appears constrained to one language without documented justification.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill advertises one-click installation, MCP configuration, and code graph construction without an upfront warning that it will globally install software and write configuration. This can lead users to approve system-level and editor-level changes without informed consent, increasing the risk of unsafe execution in sensitive environments.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 94% confidence
- Finding
The skill recommends
npx gitnexusas a fallback without pinning an exact package version.npxmay fetch the latest package from the registry at execution time, creating a supply-chain risk where a malicious or compromised upstream release could be executed on the user's machine.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 94% confidence
- Finding
This fallback command uses
npx gitnexus setupwithout a pinned version, which can download and execute whatever package version is current at runtime. Becausesetupwrites MCP/editor configuration, a compromised package could modify global developer tooling configuration unexpectedly.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 94% confidence
- Finding
Using
npx gitnexus statuswithout a version pin exposes users to execution of unreviewed upstream code fetched at runtime. Even a seemingly read-only status command still executes package code locally and can be abused if the package supply chain is compromised.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 92% confidence
- Finding
The skill again falls back to
npx gitnexus setupwithout version pinning. In context, this is particularly risky because the command modifies MCP/editor configuration globally, so a malicious package version could persistently alter developer environment settings.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 91% confidence
- Finding
The unpinned
npx gitnexus statusfallback repeats the same package resolution risk later in the workflow. Because the skill is intended for one-click setup, users are likely to execute commands verbatim, increasing the chance of silent supply-chain compromise.- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill instructs initializing a new Git repository and making an initial commit as part of troubleshooting, which goes beyond the scoped task of installing/configuring GitNexus. This broadens the action surface to repository state changes and can unintentionally capture and stage sensitive files unrelated to the user's intent.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 93% confidence
- Finding
The troubleshooting section recommends
npx gitnexus analyzewithout pinning a version, allowing untrusted code retrieval and execution from the package registry. Sinceanalyzescans the full repository and accesses source files, a malicious package could exfiltrate sensitive code or credentials.- Content
Static analysis
No suspicious patterns detected.