Unified Find Skills

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:27 PM UTC
• Version: 1.0.0

Overview

This skill is not clearly harmful, but it should be reviewed because it can search public registries and install third-party agent skills globally with confirmation skipped.

Install only after checking the selected skill's publisher, source, version, and instructions. Prefer pinned versions or immutable commits, avoid global installs unless needed, and do not use skipped-confirmation flags when installing unreviewed skills.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:85

Finding

Unpinned Third-Party Skill Retrieval and Global Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 85-112
Vulnerability Type: Unreviewed and unpinned third-party dependency installation
Risk Level: Medium

Vulnerable Code

bash

npx skills add <owner/repo@skill> -g -y

The -g flag installs globally (user-level) and -y skips confirmation prompts.

For clawhub skills:

bash

clawhub install <slug>

Optionally specify version:

bash

clawhub install <slug> --version <version>

For tessl.io skills:

bash

tessl install <skill-name>

Install from GitHub:

bash

tessl install github:user/repo

Technical Analysis

The skill instructs the agent to retrieve and install third-party skills without requiring an immutable version, commit hash, integrity digest, signature verification, or pre-installation review. The default skills.sh command combines global installation with -y, bypassing the confirmation prompt.

Related instructions elsewhere in SKILL.md also recommend executing npx skills and globally installing the clawhub and tessl command-line packages without pinning package versions. Because registry packages, tags, slugs, and repositories can change after this skill has been reviewed, the effective installed content is not fixed by the audited document.

This is a supply-chain weakness rather than evidence that any named registry is malicious. Exploitation depends on a malicious or compromised package, repository, publisher account, registry entry, or deceptively named dependency being selected for installation.

Attack Path

1. An attacker publishes a malicious skill or compromises an existing skill, repository, publisher account, or registry entry.
2. The malicious entry is returned by a registry search and appears relevant to a user's request.
3. The agent recommends or runs an installation command using a mutable slug, package name, tag, ...[truncated 1049 chars]

Remediation

View remediation

Remediation Suggestions

1. Require explicit user approval before every installation and remove -y from the default command.
2. Prefer project-local, isolated installation over global installation. Use -g only when the user specifically requests it and understands its scope.
3. Pin command-line packages and skills to reviewed versions. For GitHub sources, prefer immutable commit hashes rather than mutable branches or tags.
4. Verify publisher identity, source repository, release signatures, checksums, and package integrity metadata before installation.
5. Download and inspect each skill's instructions, scripts, manifests, lifecycle hooks, and dependency tree before enabling it.
6. Display the exact registry, source URL, resolved version or commit, requested permissions, and final command to the user before execution.
7. Where supported, disable package lifecycle scripts during initial retrieval and perform installation in a sandbox with restricted filesystem, credential, and network access.
8. Maintain an allowlist of trusted publishers and reviewed skill versions, and re-review dependencies before updates.
9. Update the documented examples to use immutable placeholders, such as a verified semantic version or commit hash, rather than an unqualified slug or repository reference.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The activation guidance is broad enough to match generic help-seeking phrases such as 'how do I do X' or 'can you do X,' which may cause this skill to trigger in many unrelated contexts. In practice that can route normal conversations into a workflow that searches registries and recommends or installs third-party skills, increasing the chance of unnecessary external lookups or package execution.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 88% confidence

Finding

The skill instructs use of npx skills find without pinning a package version, so execution depends on whatever version the registry serves at runtime. That creates a supply-chain risk: a compromised, newly published, or breaking package version could execute unintended code when the agent follows the skill.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 88% confidence

Finding

This usage again relies on unpinned npx skills, which fetches and executes the latest package version by default. In a skill whose purpose is discovery and installation of third-party extensions, that increases exposure to upstream package compromise or unexpected behavior changes.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill recommends global installation (-g) and suppression of confirmation prompts (-y) without a prominent warning about system-wide impact or trust verification. In an agent setting, this lowers friction for persistent changes to the user's environment and increases the chance of accidental or unsafe installation of third-party code.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 88% confidence

Finding

The command includes npx skills add without version pinning, so the package resolver may execute an unreviewed latest version. Because this command installs a skill globally, any compromise in the fetched package has broader persistence and system impact.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 86% confidence

Finding

The registry comparison table normalizes unpinned npx skills find <query> as the standard search flow. Even documentation-only references matter in agent skills because they are operational instructions likely to be executed automatically or semi-automatically.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 86% confidence

Finding

The install format npx skills add <owner/repo@skill> is documented without pinning the package that provides the CLI. That leaves the agent exposed to arbitrary upstream changes at execution time, which is especially sensitive in an installation workflow.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 84% confidence

Finding

npx skills update is also unpinned, which can unexpectedly pull and run a changed package version during update operations. While this is common practice, in an agent-executed context it still presents avoidable supply-chain exposure.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 87% confidence

Finding

The scaffolding command npx skills init my-xyz-skill again executes an unpinned remote package. Even though the immediate action is project initialization, it still permits arbitrary code execution from the fetched package version.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.