openmath-lean-theorem

• Outcome: Review
• Latest audit: Sep 12, 2026 · 7:12 AM UTC
• Version: 1.0.3

Overview

The skill is mostly coherent for Lean theorem setup, but its installer guidance can place mutable, unverified third-party skills into active agent skill directories.

Review carefully before installing. Prefer pinning and verifying the leanprover-skills npm package and Git repository commit, install into a staging or project-local directory first, inspect the copied skill files, and avoid setting OPENMATH_LEAN_SKILL_REPO_URL unless you fully trust the source.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:26

Finding

Unpinned npm Package Is Downloaded and Executed Through npx

Content

View full analysis

Remediation

View remediation

install lean-proof npx leanprover-skills@ install mathlib-build ``` 2. Publish the expected package version, publisher identity, and integrity hash in the Skill documentation. 3. Prefer lockfile-backed installation with npm integrity verification. 4. Use a locally installed and verified executable rather than allowing `npx` to retrieve a package implicitly. 5. Apply the same secure command consistently in `SKILL.md`, `references/proof_playbook.md`, and `references/preflight.md`. 6. Install into a staging directory first, inspect the resulting Skill files, and only then move reviewed content into an active Agent Skill directory. ]]>

T03 · Remote Payload Retrieval and Execution

Warning

• Location: scripts/check_theorem_env.py:253

Finding

Mutable and Environment-Redirectable Remote Skill Payload Is Installed into Active Agent Directories

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (15)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill describes operations that read environment variables, read and write files, and invoke shell commands, but it does not declare any explicit tool scope such as permissions or allowed-tools. In an agent setting, that weakens policy boundaries and can let a model use broader capabilities than reviewers expect while cloning repos, installing packages, or modifying local skill directories.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The command uses npx leanprover-skills install lean-proof without pinning an exact package version or integrity source. That makes execution depend on whatever version is current at install time, creating a supply-chain risk where a compromised or breaking upstream release could execute arbitrary code during installation.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The second npx leanprover-skills install command is likewise unpinned and fetches executable code from an external registry at runtime. In this skill's context, the installed component is then used in a local proving workflow, so compromise would provide a convenient path to run attacker-controlled code on the analyst's machine.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 35)May include surrounding context.

npx leanprover-skills install lean-proof npx leanprover-skills install mathlib-build

text

If you use preflight auto-install, first review the upstream repo and then pass an explicit target such as `--install-dir .codex/skills` or `--install-dir .claude/skills` so the write location is deliberate. Do not run auto-install without an explicit install dir.
- [ ] **Preflight**: Run `python3 scripts/check_theorem_env.py <workspace>` (see [references/preflight.md](references/preflight.md)).
- [ ] **Prove**: Use `lean-proof` / `mathlib-build` skills to complete the proof. See [references/proof_playbook.md](references/proof_playbook.md) for the OpenMath-specific proving loop.
- [ ] **Verify**: Confirm `lake build -q --log-level=info` passes and no `sorry` remains.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

Referencing npx leanprover-skills install ... in the external-skills note still instructs users to obtain executable tooling from an unpinned upstream source. Even though it is guidance rather than code in this file, the skill is operational documentation for an agent and can lead directly to unsafe package execution.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · references/preflight.md (reported line 14)May include surrounding context.

Optional:

bash

python3 scripts/check_theorem_env.py <workspace> --auto-install-skills --install-dir .codex/skills
python3 scripts/check_theorem_env.py <workspace> --skip-build

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · references/proof_playbook.md (reported line 29)May include surrounding context.

Optional:

bash

python3 scripts/check_theorem_env.py <workspace> --auto-install-skills --install-dir .codex/skills
python3 scripts/check_theorem_env.py <workspace> --skip-build

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence

Finding

The documentation instructs users to run npx leanprover-skills install ... without pinning a package version. npx resolves and executes code from the registry at runtime, so a compromised latest release, dependency-chain issue, or typo-squatted package could result in arbitrary code execution on the user's machine.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence

Finding

This is a second unpinned npx invocation for installing mathlib-build, carrying the same supply-chain risk as the previous finding. Because the skill is a setup/preflight guide, users are likely to copy-paste these commands directly, increasing the chance of executing unreviewed remote code.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · references/preflight.md (reported line 59)May include surrounding context.

cp -R /tmp/leanprover-skills/skills/ /

text

If you pass `--auto-install-skills`, it will only run the clone-and-copy flow when `--install-dir <path>` or `OPENMATH_LEAN_SKILL_INSTALL_DIR` is set. It will not silently choose a shared home-directory skills folder for you. Project-local paths such as `.codex/skills` or `.claude/skills` are safer than modifying a shared skills directory by accident.

## Skill Search Paths

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

The playbook instructs users to run npx leanprover-skills install ... without pinning an exact package version. npx can fetch and execute the latest published package, so a compromised upstream release or typosquatted package could lead to arbitrary code execution on the local machine during setup.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

This is a second unpinned npx leanprover-skills execution path with the same supply-chain risk. Because the skill is specifically about installing and configuring external proof tooling, users are more likely to run these commands verbatim, increasing the chance of remote code execution if the package source is compromised.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/check_theorem_env.py (reported line 89)May include surrounding context.

python

cwd: Path | None = None,
    capture: bool = True,
) -> subprocess.CompletedProcess[str]:
    return subprocess.run(
        args,
        cwd=str(cwd) if cwd else None,
        text=True,

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 88% confidence

Finding

The script prints guidance to run npx leanprover-skills install without pinning a package version, which can cause users to execute whatever version is currently published at install time. In a security-sensitive workflow that installs and runs external tooling for theorem workspaces, this creates a supply-chain risk if the package is compromised, typo-squatted, or updated maliciously.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 88% confidence

Finding

This second occurrence repeats the same unpinned npx installation guidance, again exposing users to fetching an unreviewed latest package version at execution time. Because the skill is explicitly about setting up and installing proof-related tooling, the operational context makes this more dangerous: users are likely to copy-paste and execute the command during environment bootstrap.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.