Security audit

Mutation Test Runner

Security checks for vulnerabilities and agentic risk

Overview

This mutation-testing skill is coherent, but it asks agents to install unpinned external tools and temporarily edit project code, so it needs review before use.

Install only if you are comfortable letting the agent run mutation-testing tools and modify project files. Prefer running it in a clean branch, disposable worktree, container, or CI sandbox; pin and review tool versions before use; and keep credentials out of the environment while tests and third-party tools run.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Error

Location: SKILL.md:31
Finding: Unpinned Third-Party Mutation Tools Are Downloaded and Executed
Content: View full analysis
/dev/null || npm install --save-dev @stryker-mutator/core ``` ```bash # SKILL.md:47 pip install mutmut 2>/dev/null ``` ```bash # SKILL.md:62 go install github.com/go-gremlins/gremlins/cmd/gremlins@latest ``` ### Technical Analysis The skill directs the agent to retrieve and execute mutation-testing packages without pinning reviewed versions or verifying package integrity: - `npx stryker` can resolve and execute a remotely obtained npm package. It does not specify a reviewed package version. - `npm install --save-dev @stryker-mutator/core` resolves the current package version permitted by the registry rather than a fixed, audited artifact. - `pip install mutmut` installs the currently resolved release and its transitive dependencies without a pinned version or hash. - `go install ...@latest` explicitly downloads and builds the latest available release. Because package contents and dependency resolution can change after the skill has been reviewed, execution of these commands crosses a mutable supply-chain trust boundary. Installation hooks, package entry points, build logic, or the invoked command-line tools can execute code with the permissions of the agent running the skill. Redirecting standard error to `/dev/null` in two commands also suppresses information that could alert the operator to package-resolution failures, warnings, or unexpected installation behavior. ### Attack Path 1. An attacker compromises an upstream package maintainer account, package registry entry, source repository, release process, or transitive dependency. 2. The attacker publishes a malicious version under a package name used by the skill or introduces malicious behavior into a newly resolved dependency. 3. A u ...[truncated 1537 chars]
Remediation: View remediation
/dev/null`. - Surface resolution warnings, integrity failures, and installation scripts to the operator. Example hardened patterns should use organization-approved fixed versions rather than `latest` or other floating constraints: ```bash # Use an approved, exact version and a committed lockfile. npm ci npx --no-install stryker run ...[truncated 314 chars]

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Rp1

Medium

Category: MCP Rug Pull
Confidence: 88% confidence
Finding: The skill instructs use of npx stryker without pinning an exact package version, which can fetch and execute whatever version is current at runtime. In a developer environment this creates supply-chain and reproducibility risk, especially because npx may download and run remote package code immediately.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 90% confidence
Finding: The fallback command npx stryker run is also unpinned and may execute a newly resolved package version from the registry. That exposes users to unexpected behavior or malicious package compromise, and makes results non-reproducible across runs and environments.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The manual mutation workflow explicitly edits source files in place using sed -i and backup/restore steps, but does not prominently warn users that it alters project code and may leave changes behind if a command fails or is interrupted. In the context of a testing skill, code modification is expected, but doing it directly in the working tree can still cause accidental corruption, dirty commits, or mutated code being executed outside the intended test flow.
Content: No source excerpt is available for this finding.