PuzzleTide Agent Evals

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:09 AM UTC
• Version: 0.1.1

Overview

The skill is mostly coherent for local puzzle-based agent evaluations, but its unpinned `npx` availability check can fetch and execute third-party code despite claiming no network access.

Review before installing. The puzzle evaluation workflow itself is narrow, but avoid running the `npx puzzletide --version` check unless you intentionally accept npm network resolution and third-party code execution. Prefer an already installed local binary or a pinned, reviewed package version with explicit user approval.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:31

Finding

Unpinned npm Package Execution During Availability Check

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 31–39
Vulnerability Type: Insecure third-party dependency execution
Risk Level: Medium

Vulnerable Code

bash

ptide --version
puzzletide --version
npx puzzletide --version

text

If none of those work, ask the user before installing (`npm install -g puzzletide`).

Technical Analysis

The command npx puzzletide --version is presented as an availability check. If the package is not installed or cached locally, npx may resolve, download, and execute puzzletide and its dependency tree from the npm registry. Because no version or package integrity value is specified, the code executed depends on the package contents available at invocation time.

This execution occurs before the instruction to request user approval for installation. It therefore undermines the stated consent boundary and conflicts with the safety claims that the workflow requires no network access and does not install packages without first asking the user.

Attack Path

1. Neither ptide nor puzzletide is installed locally.
2. The Agent follows the documented availability-check sequence.
3. The Agent invokes npx puzzletide --version.
4. npx resolves the unpinned package through the configured npm registry and may download it and its transitive dependencies.
5. Package lifecycle behavior or CLI entry-point code executes with the privileges of the user running the Agent.
6. If the package, a transitive dependency, or the configured registry is compromised, attacker-controlled code executes on the host.

Impact Assessment

Exploited code would run with the current Agent process user's privileges. Within those privileges, it could access readable files and environment variables, alter writable files, communicate over the network, or execute additional processes. The finding does not itself demonstrate privilege escalation, persistence, credential ...[truncated 138 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove npx puzzletide --version from the local availability checks.
2. Check only for existing local executables without running remote resolution:

   bash

   command -v ptide
   command -v puzzletide
   

3. If neither executable exists, explicitly disclose that the next action may access the network and execute third-party code, then obtain user approval.
4. After approval, use a reviewed and pinned package version rather than the mutable latest release, for example:

   bash

   npx --yes puzzletide@<reviewed-version> --version
   

5. Prefer installation from a lockfile with integrity metadata, and verify package provenance or checksums where supported.
6. Disable npm lifecycle scripts where compatible with the package and intended workflow.
7. Update the Safety section so its claims accurately describe possible npm network access, downloads, cache writes, and execution behavior.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

The skill recommends running npx puzzletide --version without a pinned version, which can fetch and execute whatever package version is current at runtime. Even though this is framed as a version check, npx may download and run remote code, creating a supply-chain risk if the package is compromised, typosquatted, or unexpectedly changed.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 79)May include surrounding context.

md

## Safety

- Everything runs locally; no account, API key, or network access.
- Do not install packages without asking the user first.

Static analysis

No suspicious patterns detected.