Security checks for vulnerabilities and agentic risk
Overview
The skill content is a normal strategy playbook, but its README recommends mutable, global, confirmation-suppressed installation commands.
Read the playbook content as ordinary business-strategy guidance, but do not follow the README install commands as written. Prefer a pinned skills CLI version, a pinned repository commit or signed release, local rather than global installation, and interactive confirmation instead of --yes. Run any scanner in a restricted environment and pin its version.
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T08 · Insecure Dependencies
Warning
Location
README.md:17
Finding
Unpinned Package Execution and Mutable Global Skill Installation
Content
View full analysis
Remediation
View remediation
add ...
```
2. Pin the GitHub source to a verified commit hash or immutable signed release rather than the default branch.
3. Publish and verify cryptographic checksums or signatures for release artifacts.
4. Remove `--yes` from the recommended interactive installation path so users can review the requested operation.
5. Prefer project-local installation over `--global` unless global scope is explicitly required.
6. Use a lockfile or equivalent integrity-controlled installation mechanism where supported.
7. Run installation in a restricted environment with minimal filesystem access, no unnecessary credentials, and limited network access.
8. Document the exact reviewed package version, repository commit, and expected integrity value.
]]>
T08 · Insecure Dependencies
Warning
Location
README.md:23
Finding
Execution of an Unpinned Latest Security Scanner Package
Content
View full analysis
Remediation
View remediation
--skills SKILL.md
```
2. Require package hash verification or use a lockfile that records exact versions and integrity values.
3. Verify release signatures and publisher identity before execution.
4. Run the scanner in a sandbox or disposable container with:
- Read-only access to the files being scanned
- No access to unrelated home-directory files
- No inherited secrets or unnecessary environment variables
- Restricted outbound network connectivity
5. Review and pin transitive dependencies where the toolchain supports it.
6. Establish an update process in which new scanner versions are reviewed and tested before changing the documented pin.
]]>
The trigger criteria are extremely broad, explicitly instructing use for 'ANY organisational learning' and almost anything involving adaptation, experimentation, competition, or strategy. This can cause the skill to activate in many ordinary business conversations, unnecessarily injecting its guidance into unrelated contexts and increasing the chance of prompt-scope hijacking, misrouting, or over-collection of strategic context.
Content
No source excerpt is available for this finding.
Rp1
Medium
Category
MCP Rug Pull
Confidence
90% confidence
Finding
The README instructs users to run npx skills add without pinning the package version, which causes execution of whatever package version is current at install time. If the upstream package, dependency chain, or publishing account is compromised, users could execute unintended code during installation; because this is an installation command in documentation, the risk is practical rather than theoretical.
Content
No source excerpt is available for this finding.
Rp1
Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding
The command uvx snyk-agent-scan@latest --skills SKILL.md explicitly requests the latest version, which is equivalent to trusting mutable upstream code at execution time. A compromised or malicious newly published version could run arbitrary code in the user's environment when they perform the advertised security scan.
