repo-agent-brief

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:02 AM UTC
• Version: 0.4.1

Overview

The skill has a coherent repository-briefing purpose, but it repeatedly tells users to run an unpinned third-party npm package inside sensitive repositories.

Review before installing or using in sensitive repositories. Prefer a pinned, reviewed version of `@builtbyecho/repo-agent-brief`, run it with minimal credentials, and check generated briefs for private code snippets before sharing them.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:12

Finding

Unpinned Third-Party Package Is Downloaded and Executed Through npx

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 12-57
Vulnerability Type: Unpinned executable dependency / supply-chain risk
Risk Level: Medium

The skill repeatedly instructs agents to execute @builtbyecho/repo-agent-brief through npx without specifying an immutable package version or verifying package integrity.

bash

npx @builtbyecho/repo-agent-brief . > AGENT_BRIEF.md
sed -n '1,220p' AGENT_BRIEF.md

npx @builtbyecho/repo-agent-brief . --diff origin/main > AGENT_HANDOFF.md
sed -n '1,260p' AGENT_HANDOFF.md

npx @builtbyecho/repo-agent-brief . --format json > agent-brief.json

npx @builtbyecho/repo-agent-brief . --diff HEAD --bundle
sed -n '1,220p' .agent-brief/brief.md
sed -n '1,160p' .agent-brief/verification.md

npx @builtbyecho/repo-agent-brief .
npx @builtbyecho/repo-agent-brief . --diff HEAD
npx @builtbyecho/repo-agent-brief . --diff HEAD --bundle
npx @builtbyecho/repo-agent-brief . --diff origin/main --fail-on-high-risk
npx @builtbyecho/repo-agent-brief . --no-snippets

Technical Analysis

When no version is supplied, npx can resolve and download the currently published package version from the configured npm registry and immediately execute its binary. Consequently, the code reviewed when this skill was authored is not necessarily the code executed later.

A malicious release, compromised publisher account, registry compromise, or unsafe registry configuration could cause attacker-controlled package code to run. Package execution is not sandboxed by these instructions. The process normally inherits the invoking user's environment, filesystem permissions, working directory, network access, and accessible credentials.

The repository-oriented nature of the command increases exposure because it is deliberately executed from the repository root and receives the repository path as input. There is no evidence that the named package is currently malicious; the vulnerability is ...[truncated 1734 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the dependency to a reviewed, exact version in every command, for example:

   bash

   npx --yes @builtbyecho/repo-agent-brief@X.Y.Z .
   

   Do not use latest, caret ranges, tilde ranges, tags, or other mutable selectors.

2. Prefer declaring the package in a controlled project manifest and committing the associated lockfile. Install dependencies with a lockfile-enforcing command such as:

   bash

   npm ci --ignore-scripts
   

   Confirm that disabling lifecycle scripts is compatible with the package before adoption.

3. Review the pinned package version, its transitive dependency graph, exposed binary, lifecycle scripts, provenance, and published integrity metadata before approving it.

4. Configure npm to use an approved registry, enforce lockfile integrity, and apply organizational package allowlisting where available.

5. Execute the tool in a sandbox or minimally privileged environment with restricted credentials, read-only repository access where practical, and controlled outbound network access.

6. In CI, do not expose deployment credentials or unrelated secrets to the analysis step. Grant the job only the repository and token permissions required for generating the brief.

7. Add an automated dependency-update process in which each proposed version change is reviewed and tested before the pinned version is changed.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (10)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The description says to use the skill "before coding-agent work, reviews, handoffs, PR analysis, unfamiliar repo edits" and other broad situations, but it does not define precise activation criteria or exclusions. This can cause the skill to be invoked for many ordinary repository interactions rather than a narrowly scoped set of cases.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The skill instructs users to execute an unpinned npm package via npx, which fetches and runs code from the registry at the latest available version. This creates a supply-chain execution risk: a compromised publisher account, malicious update, or dependency hijack could result in arbitrary code execution in the repository context.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

This command again uses unpinned npx execution against a package name, causing the tool version and its transitive code to be determined at runtime. In a skill meant to be run before repository edits and reviews, that means arbitrary third-party code may run in sensitive working copies and access source, configs, and credentials available to the environment.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

Machine-readable automation increases risk because unpinned npx execution is more likely to be embedded into scripts or CI, where it may run unattended with elevated repository or token access. A malicious or compromised package release could silently alter outputs, exfiltrate repository data, or execute arbitrary commands in automation environments.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The bundled handoff workflow still relies on unpinned npx, so the generated artifacts may be produced by whatever package version is current at execution time. Because the skill is used for durable handoffs and pre-change context, a compromised package could poison handoff content, mislead downstream agents, or run arbitrary code during preparation.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

This example normalizes unpinned execution as the default usage pattern. Repetition throughout the skill makes unsafe behavior more likely to be copied into operational workflows, increasing exposure to npm supply-chain compromise and arbitrary code execution.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The diff mode command still executes an unpinned remote package, which is especially risky because users may run it on active branches containing proprietary or security-sensitive changes. Any malicious package update would execute with access to those changes and the developer environment.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The --bundle example may collect and persist repository context, making unpinned execution particularly dangerous if a compromised package manipulates or exfiltrates gathered content. Because the command is framed as a durable handoff workflow, the blast radius includes both code execution and contamination of artifacts trusted by later agents or reviewers.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

Using --fail-on-high-risk does not mitigate the more fundamental risk that the scanner itself is fetched and executed unpinned at runtime. A malicious package could subvert the reported risk level, bypass expected checks, or execute arbitrary code before any safety gating occurs.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

Even the safer --no-snippets variant still invokes unpinned third-party code, so reducing output sensitivity does not remove the execution risk. The core issue remains arbitrary code retrieval and execution from the npm ecosystem without version or integrity constraints.

Content

No source excerpt is available for this finding.