Gumroad Product Images" --version 1.0.0 --changelog "Initial release: cover + preview image generation for Gumroad products"

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 4:51 AM UTC
• Version: 1.0.0

Overview

This skill is coherent for generating Gumroad product images locally, with a hardening note about its unpinned local server command.

Before installing or using this skill, prefer a pinned or already-installed local HTTP server, bind it to 127.0.0.1, serve only the generated image directory, remove CORS unless needed, and stop the server after screenshots are created.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:47

Finding

Unpinned npm Package Execution Through npx

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 47
Vulnerability Type: Unpinned third-party dependency execution
Risk Level: Medium

Vulnerable Code

powershell

cd <product-images-dir>; npx http-server -p 8765 --cors -c-1

Technical Analysis

The documented workflow instructs the agent to execute http-server through npx without specifying an exact package version or requiring an existing reviewed local installation. When the package is unavailable locally, npx may retrieve and execute the registry's currently resolved version.

Consequently, the code that runs is not fully determined by the reviewed project. A compromised npm package, maintainer account, registry response, or transitive dependency could introduce executable code after the Skill itself has been audited.

The --cors option also makes resources served by this process readable by arbitrary web origins. This can unnecessarily expose files under the selected document root while the server is active. The server is described as local, but the command does not explicitly bind it to the loopback interface.

Attack Path

1. An agent follows the workflow in SKILL.md.
2. The agent runs the documented npx http-server command.
3. If no suitable local package is present, npx resolves the package through the configured npm registry.
4. An attacker who has compromised the package, its maintainer, the registry configuration, or a dependency causes malicious installation or runtime code to be delivered.
5. The downloaded code executes with the privileges and environment access of the user running the agent.
6. The malicious process can access resources available to that user, including project files and potentially environment variables or credentials.
7. Separately, broad CORS and failure to specify a loopback bind address may expose locally served files beyond what screenshot generation requires, depending on http-server defaults and host firewall/net ...[truncated 625 chars]

Remediation

View remediation

Remediation Suggestions

1. Add an audited dependency manifest and lockfile to the project, pinning http-server and all transitive dependencies to reviewed versions.
2. Perform dependency installation as an explicit, reviewable setup operation rather than allowing runtime retrieval.
3. During normal operation, use npx --no-install http-server ... so execution fails instead of downloading an unavailable package.
4. If runtime invocation is unavoidable, specify an exact version rather than a floating package name, although a committed lockfile and reviewed installation remain preferable.
5. Verify package integrity and provenance, retain the lockfile in version control, and use dependency vulnerability and integrity scanning.
6. Prefer a built-in or already trusted local HTTP server that does not require downloading executable code.
7. Explicitly bind the server to 127.0.0.1.
8. Remove --cors unless cross-origin access is demonstrably necessary. If it is necessary, restrict allowed origins rather than permitting all origins.
9. Serve a dedicated directory containing only generated image assets, not a broader project or user directory.
10. Terminate the server immediately after screenshots are generated.

A hardened invocation, after a reviewed installation, would follow this pattern:

powershell

cd <product-images-dir>
npx --no-install http-server -a 127.0.0.1 -p 8765 -c-1

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence

Finding

The skill instructs users to run npx http-server without pinning a specific package version. This allows whatever version is current at execution time to be fetched and run, which creates a supply-chain risk if the package is updated maliciously, compromised, or changed incompatibly. Because the command executes code locally, compromise could affect the user's workstation or build environment.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.