Eslint Flat Config Validator

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:19 AM UTC
• Version: 1.0.1

Overview

The skill is a legitimate ESLint JSON validator, but it tells users and CI to run project JavaScript during export without warning, which can expose local or CI secrets if used on untrusted code.

Review carefully before installing. Use the validator on JSON snapshots from trusted projects, or generate snapshots inside a disposable sandbox/container with no secrets, no credential mounts, restricted network access, and a read-only repository mount. Avoid running the documented Node export step on untrusted pull requests or privileged CI runners.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:13

Finding

Untrusted ESLint Configuration Is Executed During JSON Export

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 13–18 and 118–121
Vulnerability Type: Unsafe execution of untrusted configuration code
Risk Level: High

Vulnerable Code

The primary export instructions at lines 13–18 state:

bash

node -e "import('./eslint.config.js').then(m => console.log(JSON.stringify(m.default)))" > eslint.config.json

The CI integration example at lines 118–121 repeats the same unsafe operation:

yaml

- name: Validate ESLint flat config
  run: |
    node -e "import('./eslint.config.js').then(m => console.log(JSON.stringify(m.default)))" > /tmp/eslint.config.json
    python3 scripts/eslint_flat_config_validator.py validate /tmp/eslint.config.json --strict --format json

Technical Analysis

The documented prerequisite uses Node.js dynamic import() to load eslint.config.js. Importing a JavaScript module evaluates its top-level code and loads its transitive dependencies. Consequently, this operation is not a passive conversion from configuration to JSON: it executes the target configuration with the full permissions and environment of the invoking developer or CI runner.

The Skill is advertised for auditing ESLint projects and reviewing changes to eslint.config.js, but the instructions do not warn that the target configuration must be trusted or require execution inside a restricted sandbox. A malicious configuration can therefore run arbitrary JavaScript before the Python validator receives any JSON. Validation cannot detect or prevent actions that already occurred during import.

The Python validator itself does not execute the supplied JSON and contains no identified network, subprocess, persistence, environment-harvesting, or filesystem-mutation behavior. The vulnerability is specifically in the documented export workflow.

Attack Path

1. An attacker submits or distributes a modified eslint.config.js, such as through an untrusted pull request ...[truncated 1489 chars]

Remediation

View remediation

Remediation Suggestions

1. Add a prominent warning that dynamic import executes the complete ESLint configuration and must only be used with trusted code.
2. Do not execute configuration from untrusted pull requests on privileged, persistent, or secret-bearing CI runners.
3. Perform export in a disposable sandbox or container configured with:
   • An unprivileged user.
   • No injected secrets or sensitive environment variables.
   • Disabled outbound network access.
   • A read-only repository mount.
   • No host socket, home-directory, SSH-agent, or credential mounts.
   • Strict CPU, memory, process, and execution-time limits.
   • Destruction of the environment immediately after export.
4. Prefer accepting a JSON snapshot generated in a trusted environment when reviewing untrusted projects.
5. Where practical, use a non-executing static parser to inspect supported configuration syntax rather than evaluating JavaScript.
6. Apply the same safeguards and warning to both the general usage instructions and the CI integration example.

SkillSpector

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.