Partnerships Ecosystem

• Outcome: Review
• Latest audit: Sep 11, 2026 · 9:29 AM UTC
• Version: 0.1.0

Overview

The skill content is a coherent partnerships playbook, but its README recommends unpinned remote commands and global installation that users should review carefully before running.

Read the skill as business strategy guidance, but avoid copy-pasting the README commands as written. Prefer a pinned skills CLI version, a specific commit or signed release of the repository, no --yes, and project-local installation unless you intentionally want it available globally. Run any scanner command with a pinned version in a minimal or disposable environment.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: README.md:14
• Finding: Unpinned Global Installation from Mutable Remote Sources## Vulnerability Details **File Location**: `README.md`, lines 14–18 **Vulnerability Type**: Unpinned third-party dependencies and mutable Git repository installation **Risk Level**: Medium ### Vulnerable Code ```markdown ## Install ```bash npx skills add https://github.com/Hey-Salad/partnerships-ecosystem-skill --skill partnerships-ecosystem --yes --global ``` ``` ### Technical Analysis The documented installation command invokes the `skills` package through `npx` without specifying an audited package version. It also installs Skill content directly from a GitHub repository without pinning it to a commit hash or immutable release artifact. Consequently, the command may retrieve content that differs from the version covered by this audit. The `--yes` option suppresses interactive confirmation, while `--global` increases the installation scope. Although no malicious content was found in the audited project files, the command creates a supply-chain risk because both the package resolved by `npx` and the repository contents can change after review. ### Attack Path 1. An attacker compromises the npm package, GitHub repository, release process, or a maintainer account. 2. The attacker publishes a modified package version or replaces repository content with malicious Skill instructions or another payload. 3. A user copies and executes the installation command from `README.md`. 4. `npx` resolves the unpinned package, and the installer retrieves the current mutable repository content. 5. The `--yes` option bypasses confirmation, and the content is installed globally. 6. Any malicious behavior supported by the compromised installer or installed content runs under the permissions of the invoking user. ### Impact Assessment A compromised package or repository could alter globally installed Skill content and affect compatible agent sessions that load it. If the invoked package executes installation hooks or other code, c ...[truncated 266 chars]
• Remediation: ## Remediation Suggestions 1. Pin the `skills` CLI to an exact, audited version rather than allowing `npx` to resolve a mutable version. 2. Pin the GitHub source to a full commit SHA or use a signed, immutable release artifact. 3. Publish and verify a cryptographic checksum or signature for the Skill package. 4. Remove `--yes` so users can review the requested operation before installation. 5. Avoid `--global` unless global installation is operationally necessary; prefer a project-local or isolated installation. 6. Document the exact versions and commit reviewed by the security audit. 7. Re-audit and update integrity metadata whenever dependencies or Skill content change.

T08 · Insecure Dependencies

Warning

• Location: README.md:20
• Finding: Execution of an Unpinned Latest Security-Scanner Package## Vulnerability Details **File Location**: `README.md`, lines 20–24 **Vulnerability Type**: Execution of a mutable third-party package **Risk Level**: Medium ### Vulnerable Code ```markdown ## Security Scan ```bash uvx snyk-agent-scan@latest --skills SKILL.md ``` ``` ### Technical Analysis The documented scan command directs `uvx` to retrieve and execute `snyk-agent-scan@latest`. The `latest` selector is mutable and does not identify the specific package artifact covered by this audit. A later release can therefore introduce different code without any corresponding change to this repository. Security tooling is not inherently trusted merely because it performs a scan. Running a remotely resolved package gives that package code execution within the invoking user's environment. Without an exact version, lockfile, hash, or signature verification, users cannot reliably establish that the executed artifact is the reviewed one. ### Attack Path 1. An attacker compromises the package registry entry, publisher account, release pipeline, or a transitive dependency. 2. A malicious package version is published and becomes the version selected by `latest`. 3. A user follows the README and runs the documented command. 4. `uvx` downloads the newly selected package and its dependencies. 5. The package executes locally as the invoking user. 6. Malicious package code can access resources available to that user and perform actions permitted in the execution environment. ### Impact Assessment Successful exploitation could result in arbitrary code execution with the invoking user's privileges. Depending on the local environment and permissions, exposed resources could include files readable or writable by that user, environment variables, source code, and accessible network services. No evidence shows that the currently audited project performs such actions; the risk arises from executing an unpinned future package artifact.
• Remediation: ## Remediation Suggestions 1. Replace `@latest` with an exact, audited package version. 2. Use a lockfile or equivalent mechanism that pins all transitive dependencies. 3. Require hash or signature verification before executing the scanner. 4. Run the scanner in a sandbox or disposable container with minimal filesystem access, no unnecessary credentials, and restricted network permissions. 5. Review release notes and re-audit the package before upgrading. 6. In CI, grant the scanner only the repository read access and output permissions required for its task.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Vague Triggers

High

• Confidence: 98% confidence
• Finding: The skill explicitly says to trigger on ANY partnership, alliance, channel, ecosystem, supplier, or business development topic and even adds 'If in doubt, use this skill,' making invocation criteria far broader than necessary. This can cause the agent to activate the skill in loosely related contexts, increasing prompt-surface area, overshadowing more appropriate domain skills, and potentially steering outputs with irrelevant or risky instructions.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence
• Finding: The README instructs users to execute `npx skills` directly from the registry without pinning an exact version. That allows whatever package version is current at install time to run code on the user's machine, so a compromised, malicious, or breaking upstream release could be executed implicitly. In a skill-installation context, this is more dangerous because users are explicitly encouraged to copy-paste the command as part of setup.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence
• Finding: The security scan example runs `uvx snyk-agent-scan@latest`, which fetches and executes the latest published version rather than a fixed, reviewed release. Using `@latest` creates a supply-chain risk: a compromised or malicious new release could be executed immediately by anyone following the README. The fact that this appears in a security-related command does not reduce risk; it may increase trust and make users less cautious.

Static analysis

No suspicious patterns detected.