PuzzleTide Sudoku

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:18 AM UTC
• Version: 0.1.1

Overview

This Sudoku skill is coherent, but it can run an unpinned npm package via npx before clear user approval despite saying it needs no network or installation.

Review this skill before installing. It appears intended for Sudoku work, but only use it if you are comfortable with the PuzzleTide npm package being installed or executed. Prefer a pinned, reviewed version and do not let the agent run `npx puzzletide` until you have explicitly approved network package retrieval and third-party code execution.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:12

Finding

Unpinned npm Package May Be Retrieved and Executed Before User Consent

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 12–15 and 33–39
Vulnerability Type: Unpinned third-party dependency retrieval and execution
Risk Level: Medium

Vulnerable Code

yaml

install:
  - kind: node
    package: puzzletide
    bins: ["ptide", "puzzletide"]

markdown

Prefer the local CLI. Check availability in this order:

```bash
ptide --version
puzzletide --version
npx puzzletide --version

If none of those work, ask the user before installing (npm install -g puzzletide).

text

### Technical Analysis

The installation metadata and `npx` fallback identify the npm package only by its mutable package name, without an exact version or integrity constraint. When no local binary is present, `npx puzzletide --version` may contact the npm registry, retrieve the currently resolved release, and execute its CLI entry point.

This behavior occurs before the instruction to ask the user for permission to install the package. As a result, the consent requirement does not reliably protect the first remote retrieval and execution. It also conflicts with the safety statement that the skill requires no network access and does not install packages without prior approval.

Because an npm package executes code with the privileges of the invoking user, compromise of the package, its transitive dependencies, its registry namespace, or a future release could turn this version check into arbitrary local code execution.

### Attack Path

1. The expected `ptide` and `puzzletide` binaries are not installed locally.
2. The agent follows the documented fallback and invokes `npx puzzletide --version`.
3. `npx` resolves the unpinned `puzzletide` package through the configured npm registry and may download it into the local npm cache.
4. A compromised or unexpectedly modified package release is selected because no exact audited version or integrity value is required.
5. The package CLI and
...[truncated 1094 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove npx puzzletide --version from the pre-consent availability checks. Only inspect already installed binaries before asking the user whether remote retrieval is permitted.
2. If npx remains supported, request explicit user approval before invoking it and clearly state that it may access the network, download package content, populate npm caches, and execute third-party code.
3. Pin the dependency to a reviewed exact version, such as puzzletide@X.Y.Z, rather than resolving the mutable latest release.
4. Verify package integrity using an approved lockfile, npm integrity metadata, a trusted internal registry, or an equivalent reproducible dependency-verification mechanism.
5. Review and pin transitive dependencies where the installation framework permits it.
6. Prefer installation into an isolated, least-privileged environment rather than a global npm installation.
7. Update the Safety section so its network-access and installation claims accurately reflect the behavior of all documented fallback commands.
8. Fail closed if the approved version or integrity check cannot be satisfied; do not silently fall back to the latest registry release.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

The skill instructs use of npx puzzletide without pinning an exact package version, which can fetch and execute whatever version is current at runtime. That creates a supply-chain risk: a compromised upstream release, typo-squat, or unexpected breaking change could result in execution of unreviewed code on the local machine.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 88)May include surrounding context.

md

## Safety

- Everything runs locally; no account, API key, or network access.
- Do not install packages without asking the user first.

Static analysis

No suspicious patterns detected.