Test Impact Analyzer

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 7:15 AM UTC
• Version: 1.0.1

Overview

This skill provides disclosed repository test-impact analysis commands, with manageable cautions around broad activation wording and unpinned npx examples.

Install only if you are comfortable with the agent inspecting repository paths, imports, test files, and recent git history. If adopting the CI example, avoid implicit package downloads by installing locked dependencies first and invoking the local Jest binary or a pinned command.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:256

Finding

Unpinned Jest Execution Through npx in CI

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 256–261; operational CI example at lines 293–297
Vulnerability Type: Supply-chain exposure through unpinned executable dependency resolution
Risk Level: Medium

Vulnerable Code

bash

# For Jest
JEST_TESTS=$(echo "$UNIQUE_TESTS" | grep -E '\.(test|spec)\.(ts|js|tsx|jsx)$' | tr '\n' ' ')
if [ -n "$JEST_TESTS" ]; then
  echo "Jest command:"
  echo "  npx jest --passWithNoTests $JEST_TESTS"
fi

The generated command is then demonstrated as an operational CI step:

yaml

- name: Run affected tests
  if: steps.tests.outputs.count > 0
  run: npx jest $(cat affected-tests.txt | tr '\n' ' ')

Technical Analysis

The documented CI workflow invokes npx jest without requiring a trusted local Jest installation, pinned package version, immutable lockfile installation, or no-download option. Depending on the npm/npx version and environment, npx can resolve and download Jest when the executable is unavailable locally.

This creates a supply-chain trust boundary at execution time: the code executed by CI may be determined by the package registry and current dependency-resolution state rather than solely by reviewed and locked repository content. A registry compromise, package-account compromise, registry substitution, or unintended package resolution could therefore cause unreviewed code to run.

This finding does not establish that Jest itself is malicious. The weakness is the documented use of dynamic, unpinned executable resolution in an automated environment.

Attack Path

1. A repository adopts the documented GitHub Actions example.
2. The CI runner does not contain a trusted, locally installed Jest executable.
3. The workflow executes npx jest ....
4. npx resolves or downloads the executable package through the configured npm registry.
5. If that resolution channel or package is compromised, attacker-controlled package or executable code runs on the CI runner.
6. The mal ...[truncated 824 chars]

Remediation

View remediation

Remediation Suggestions

1. Declare Jest as a pinned development dependency and commit the package lockfile.

2. Install dependencies using an immutable command such as:

   bash

   npm ci
   

3. Invoke only the repository-local executable and prohibit implicit downloads, for example:

   bash

   npm exec --no -- jest --passWithNoTests ...
   

   Alternatively:

   bash

   ./node_modules/.bin/jest --passWithNoTests ...
   

4. Add an explicit CI check that fails if the expected local executable is absent rather than allowing runtime package retrieval.

5. Pin third-party GitHub Actions to immutable commit SHAs and apply registry allowlisting or an approved internal proxy where appropriate.

6. Use lockfile integrity checks, dependency review, and package provenance verification.

7. Restrict CI permissions and secrets according to least privilege so that compromise of a test dependency has limited impact.

8. When passing selected tests, prefer a safely structured argument mechanism rather than constructing a shell command from a whitespace-delimited string.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill advertises broad trigger phrases like 'which tests should I run' and 'what does this change affect', which are common in routine developer conversation. In agent environments with automatic or fuzzy skill selection, this can cause unintended activation and execution of repository-scanning shell commands, exposing codebase metadata and increasing the chance of unsafe command execution in the wrong context.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.