PuzzleTide Crossword

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:18 AM UTC
• Version: 0.1.1

Overview

This is mostly a coherent crossword-generation skill, but it may fetch and run an unpinned npm package before the user has clearly approved that risk.

Review this skill before installing. It should be safest when PuzzleTide is already installed locally or when any package install/download is explicitly approved and version-pinned. Avoid letting an agent run the `npx puzzletide --version` fallback automatically in sensitive workspaces.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:30

Finding

Unpinned Third-Party Package Retrieval and Execution Through npx

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 30–36
Vulnerability Type: Unpinned third-party dependency execution
Risk Level: High

Vulnerable Code

markdown

Prefer the local CLI. Check availability in this order:

```bash
ptide --version
puzzletide --version
npx puzzletide --version

If none of those work, ask the user before installing (npm install -g puzzletide).

text

### Technical Analysis

The skill instructs the agent to execute `npx puzzletide --version` when the expected local binaries are unavailable. If the package is not already present in the local npm cache, `npx` can retrieve it from the configured npm registry and execute its code. No exact package version, package integrity hash, lockfile, or trusted artifact digest is specified.

This creates a supply-chain trust boundary in which the effective executable can change after the skill has been audited. A compromised npm account, malicious newly published release, registry compromise, or unexpected package ownership change could cause attacker-controlled package code to run.

The `npx` command also appears before the instruction to request permission for package installation. Consequently, package retrieval and execution may occur before the user provides the consent that the skill requires for `npm install -g puzzletide`. This conflicts with the Safety section's assertions that package installation requires permission and that no network access is needed.

### Attack Path

1. An attacker compromises the `puzzletide` npm package, its publisher account, or its distribution channel and publishes a malicious release.
2. A user requests crossword generation in an environment where neither `ptide` nor `puzzletide` is installed locally.
3. Following `SKILL.md`, the agent executes `npx puzzletide --version`.
4. `npx` resolves the unpinned package name through the configured npm registry and may download the current package release.
5. Package lifecycle behavior or the 
...[truncated 1009 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the automatic npx puzzletide --version fallback. Check only already-installed local binaries by default.
2. Obtain explicit user consent before any command that may contact a package registry, download a package, install dependencies, or execute newly retrieved code.
3. Pin the dependency to a reviewed exact version rather than resolving the latest release, for example by referencing an approved version such as puzzletide@<exact-version>.
4. Verify the downloaded artifact against an independently maintained integrity hash or trusted lockfile before execution.
5. Prefer a project-local, locked dependency installation over a global installation. Use npm lockfiles and deterministic installation mechanisms such as npm ci.
6. Disable package lifecycle scripts where compatible, and inspect the selected package version before permitting execution.
7. Run the CLI in a restricted container or sandbox with minimal filesystem access, no secrets, limited network connectivity, and no elevated privileges.
8. Update the Safety section to disclose that npx may use the network and retrieve executable package content.
9. Document the approved package source, exact version, integrity value, and update-review procedure so package upgrades require a new security review.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 89% confidence

Finding

The skill recommends running npx puzzletide --version without pinning a package version. npx may fetch and execute the latest package from the registry if the binary is not already installed locally, which creates a supply-chain risk: a compromised package, typosquat, or malicious newly-published version could run arbitrary code on the host. In this skill, the risk is elevated because the command is presented as part of the normal availability check flow.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 92)May include surrounding context.

md

## Safety

- Puzzles are generated locally; no account, API key, or network access.
- Do not install packages without asking the user first.

Static analysis

No suspicious patterns detected.