Test

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 8:52 PM UTC
• Version: 1.0.0

Overview

The skill is a coherent CLI usage guide for rendering and generating image schemas, with ordinary but notable dependency and AI-provider privacy risks users should understand.

Before installing, verify the `materials-cli` npm package and publisher, prefer a pinned or project-local install where possible, and avoid putting secrets or confidential data in generation prompts because they may be sent to OpenAI or the configured base URL.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:28

Finding

Unpinned Global Installation of a Third-Party npm Package

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 28
Vulnerability Type: Unpinned and globally installed third-party dependency
Risk Level: Medium

Vulnerable Code

markdown

Run via Node (from the project or after `npm install -g materials-cli`):

Technical Analysis

The documentation directs users to install materials-cli globally without specifying an exact package version or integrity hash. Consequently, npm resolves the mutable package version currently published under that name. The audited project contains no implementation source, package manifest, lockfile, integrity metadata, or publisher verification that would allow the downloaded code to be compared with a reviewed version.

An npm package can execute code through lifecycle scripts during installation and through its CLI entry point when subsequently invoked. Global installation also exposes the package executable outside an isolated project dependency tree. This is a supply-chain risk: the instruction is not itself proof that materials-cli is malicious, but compromise of the package, its publisher account, or its distribution channel could convert the documented installation step into arbitrary local code execution.

Attack Path

1. An attacker compromises the npm package, its publisher credentials, or another relevant package in its dependency chain.
2. The attacker publishes a modified release containing a malicious lifecycle script or CLI implementation.
3. A user follows the instruction at SKILL.md:28 without an exact version or integrity constraint.
4. npm resolves and downloads the attacker-controlled release.
5. Malicious lifecycle code may execute during installation, or malicious CLI code executes when the user runs a documented materials command.
6. The payload operates with the permissions of the account performing the installation or running the CLI.

Impact Assessment

Successful exploitation could allow arbitrary code execution with the ...[truncated 642 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the dependency to an exact, reviewed version rather than allowing npm to resolve the latest mutable release.
2. Provide a lockfile and verify package integrity through npm integrity metadata or an equivalent cryptographic digest.
3. Document the canonical package registry, package owner, and trusted publisher so users can verify provenance.
4. Prefer a project-local dependency over a global installation to reduce scope and improve reproducibility.
5. Where compatible with package functionality, install with lifecycle scripts disabled and execute only after reviewing the package contents.
6. Include the auditable CLI implementation in the project or link to immutable, versioned source corresponding exactly to the distributed package.
7. Avoid elevated installation privileges and run the CLI under a least-privileged account with access only to required files and secrets.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill explicitly supports sending user prompts to OpenAI via the generate command and references API key and base URL options, but it does not disclose that prompt content may be transmitted to an external service. This can lead users to unknowingly send sensitive data, proprietary schema content, or internal descriptions off-system, especially in agent workflows where prompts may include contextual data.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.