Adaptive Learning Playbook

• Outcome: Review
• Latest audit: Sep 11, 2026 · 9:24 AM UTC
• Version: 0.1.0

Overview

The skill content is a normal strategy playbook, but its README recommends mutable, global, confirmation-suppressed installation commands.

Read the playbook content as ordinary business-strategy guidance, but do not follow the README install commands as written. Prefer a pinned skills CLI version, a pinned repository commit or signed release, local rather than global installation, and interactive confirmation instead of --yes. Run any scanner in a restricted environment and pin its version.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: README.md:17
• Finding: Unpinned Package Execution and Mutable Global Skill Installation<![CDATA[ ## Vulnerability Details **File Location**: `README.md`, line 17 **Vulnerability Type**: Unpinned third-party package execution and mutable remote installation **Risk Level**: Medium ### Vulnerable Code ```bash npx skills add https://github.com/Hey-Salad/adaptive-learning-playbook-skill --skill adaptive-learning-playbook --yes --global ``` ### Technical Analysis The installation command invokes the `skills` npm package through `npx` without specifying an exact, audited package version. Depending on the local environment, `npx` can download and execute the package resolved by the registry at invocation time. The command also installs the Skill from a mutable GitHub repository URL rather than a specific commit hash or signed release. Consequently, the package and Skill content executed or installed by future users may differ from the content reviewed during this audit. The `--yes` option suppresses confirmation, while `--global` increases the installation scope beyond the current project. No evidence indicates that the currently reviewed repository is malicious. The vulnerability is the unsafe supply-chain pattern documented for users. ### Attack Path 1. An attacker compromises the npm package, its maintainer account, the package registry path, or the referenced GitHub repository. 2. The attacker publishes malicious package logic or modifies the repository's mutable default branch. 3. A user follows the documented installation command. 4. `npx` resolves and executes the unpinned package, which retrieves content from the mutable repository. 5. The malicious logic runs with the invoking user's permissions. 6. The compromised Skill is installed globally, potentially affecting multiple projects or later agent sessions for that user. ### Impact Assessment Successful exploitation could execute arbitrary code with the permissions of the user running the command. This could permit access to files, environment variables, developer credentials, source ...[truncated 399 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin the `skills` CLI to a reviewed exact version instead of relying on registry resolution: ```bash npx --yes skills@<audited-exact-version> add <source> ... ``` 2. Pin the GitHub source to a verified commit hash or immutable signed release rather than the default branch. 3. Publish and verify cryptographic checksums or signatures for release artifacts. 4. Remove `--yes` from the recommended interactive installation path so users can review the requested operation. 5. Prefer project-local installation over `--global` unless global scope is explicitly required. 6. Use a lockfile or equivalent integrity-controlled installation mechanism where supported. 7. Run installation in a restricted environment with minimal filesystem access, no unnecessary credentials, and limited network access. 8. Document the exact reviewed package version, repository commit, and expected integrity value. ]]>

T08 · Insecure Dependencies

Warning

• Location: README.md:23
• Finding: Execution of an Unpinned Latest Security Scanner Package<![CDATA[ ## Vulnerability Details **File Location**: `README.md`, line 23 **Vulnerability Type**: Execution of a mutable third-party dependency **Risk Level**: Medium ### Vulnerable Code ```bash uvx snyk-agent-scan@latest --skills SKILL.md ``` ### Technical Analysis The command directs `uvx` to obtain and execute the `latest` release of `snyk-agent-scan`. The `latest` selector is mutable and does not identify the package version reviewed at the time this documentation was written. No integrity hash, lockfile, or signature verification is specified. Although the command is presented as a security scan, the downloaded package executes locally with the invoking user's permissions. A compromised maintainer account, malicious future release, package registry compromise, or dependency compromise could therefore turn the scanning step into an arbitrary code-execution channel. No evidence indicates that the current scanner release is malicious. The finding concerns the unsafe use of an unpinned executable dependency. ### Attack Path 1. An attacker compromises the scanner package, a transitive dependency, its publisher account, or the relevant package distribution channel. 2. The attacker publishes a malicious release selected by the mutable `latest` tag. 3. A user follows the README and runs the documented scan command. 4. `uvx` downloads and executes the attacker-controlled release. 5. The malicious process runs under the user's account and can access resources available in its execution environment. ### Impact Assessment Successful exploitation could result in arbitrary code execution with the invoking user's privileges. Potentially exposed resources include project files, environment variables, local credentials, source-control tokens, SSH configuration, and other data accessible to the user. The documented command does not itself request elevated privileges or persistence. Therefore, the confirmed scope is limited to the user's existing permissions unl ...[truncated 71 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace `@latest` with an exact, audited scanner version: ```bash uvx snyk-agent-scan==<audited-exact-version> --skills SKILL.md ``` 2. Require package hash verification or use a lockfile that records exact versions and integrity values. 3. Verify release signatures and publisher identity before execution. 4. Run the scanner in a sandbox or disposable container with: - Read-only access to the files being scanned - No access to unrelated home-directory files - No inherited secrets or unnecessary environment variables - Restricted outbound network connectivity 5. Review and pin transitive dependencies where the toolchain supports it. 6. Establish an update process in which new scanner versions are reviewed and tested before changing the documented pin. ]]>

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Vague Triggers

High

• Confidence: 98% confidence
• Finding: The trigger criteria are extremely broad, explicitly instructing use for 'ANY organisational learning' and almost anything involving adaptation, experimentation, competition, or strategy. This can cause the skill to activate in many ordinary business conversations, unnecessarily injecting its guidance into unrelated contexts and increasing the chance of prompt-scope hijacking, misrouting, or over-collection of strategic context.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence
• Finding: The README instructs users to run `npx skills add` without pinning the package version, which causes execution of whatever package version is current at install time. If the upstream package, dependency chain, or publishing account is compromised, users could execute unintended code during installation; because this is an installation command in documentation, the risk is practical rather than theoretical.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence
• Finding: The command `uvx snyk-agent-scan@latest --skills SKILL.md` explicitly requests the latest version, which is equivalent to trusting mutable upstream code at execution time. A compromised or malicious newly published version could run arbitrary code in the user's environment when they perform the advertised security scan.

Static analysis

No suspicious patterns detected.