PuzzleTide Printable Puzzles

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:09 AM UTC
• Version: 0.1.1

Overview

The skill is mostly a straightforward printable-puzzle CLI helper, but it tells agents to run an unpinned npx command that can download and execute package code despite claiming no network access.

Review this skill before installing. It is suitable for local puzzle generation, but remove or avoid the `npx puzzletide --version` fallback unless you explicitly approve downloading and executing the npm package, preferably pinned to a known version.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Warning

• Location: SKILL.md:29

Finding

Unapproved Remote Package Retrieval and Execution Through npx

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 29-35
Vulnerability Type: Remote retrieval and execution of an unpinned npm package
Risk Level: Medium

bash

Prefer the local CLI. Check availability in this order:

```bash
ptide --version
puzzletide --version
npx puzzletide --version

text

### Technical Analysis

The skill instructs the agent to execute `npx puzzletide --version` as an availability check. When the package is not already available locally, `npx` may contact the configured npm registry, retrieve the `puzzletide` package, and execute its CLI entry point. Because no exact package version or integrity value is specified, the code executed can change after the skill has been reviewed.

This behavior conflicts with the later instruction to obtain user approval before installing the package and with the claim that the skill requires no network access. Checking a package through `npx` is not equivalent to checking for an existing local executable because it can cross the network boundary and introduce executable third-party code.

The primary classification is remote payload retrieval and execution because the effective code is obtained from an external package registry at runtime. It also presents a supply-chain risk due to the unpinned dependency.

### Attack Path

1. Neither `ptide` nor `puzzletide` is installed locally.
2. The agent follows the documented availability-check sequence.
3. The agent invokes `npx puzzletide --version`.
4. `npx` resolves the unpinned package through the configured npm registry and may prompt for or perform temporary package installation.
5. A compromised package release, dependency, registry, or registry configuration supplies attacker-controlled code.
6. The downloaded package or its dependency code executes with the operating-system privileges of the user running the agent.

### Impact Assessment

Successful exploitation could execute arbitrary c
...[truncated 562 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove npx puzzletide --version from the pre-consent availability checks.
2. Check only for existing local executables, for example with command -v ptide and command -v puzzletide.
3. Ask for explicit user approval before any command that can contact a package registry, download a package, or execute newly retrieved code.
4. If the user approves installation or temporary execution, pin an audited exact package version rather than resolving the latest release.
5. Use a trusted, explicitly configured npm registry and verify package integrity or provenance where supported.
6. Disable dependency lifecycle scripts where feasible and confirm that the required CLI remains functional under that restriction.
7. Update the safety documentation to disclose any required network access and distinguish local executable discovery from remote package retrieval.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The skill explicitly recommends npx puzzletide --version as a fallback without pinning an exact package version. npx may fetch and execute the latest package from the registry, which creates a supply-chain risk if the package is compromised, ownership changes, or a malicious update is published. In this skill context, that risk is somewhat elevated because users are told to prefer local execution but are still given a seamless remote-execution fallback.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 79)May include surrounding context.

md

## Safety

- Everything runs locally; no account, API key, or network access.
- Do not install packages without asking the user first.

Static analysis

No suspicious patterns detected.