Partnerships Ecosystem

• Outcome: Review
• Latest audit: Sep 11, 2026 · 9:29 AM UTC
• Version: 0.1.0

Overview

The skill content is a coherent partnerships playbook, but its README recommends unpinned remote commands and global installation that users should review carefully before running.

Read the skill as business strategy guidance, but avoid copy-pasting the README commands as written. Prefer a pinned skills CLI version, a specific commit or signed release of the repository, no --yes, and project-local installation unless you intentionally want it available globally. Run any scanner command with a pinned version in a minimal or disposable environment.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: README.md:14

Finding

Unpinned Global Installation from Mutable Remote Sources

Content

View full analysis

Vulnerability Details

File Location: README.md, lines 14–18
Vulnerability Type: Unpinned third-party dependencies and mutable Git repository installation
Risk Level: Medium

Vulnerable Code

markdown

## Install

```bash
npx skills add https://github.com/Hey-Salad/partnerships-ecosystem-skill --skill partnerships-ecosystem --yes --global

text

### Technical Analysis

The documented installation command invokes the `skills` package through `npx` without specifying an audited package version. It also installs Skill content directly from a GitHub repository without pinning it to a commit hash or immutable release artifact.

Consequently, the command may retrieve content that differs from the version covered by this audit. The `--yes` option suppresses interactive confirmation, while `--global` increases the installation scope. Although no malicious content was found in the audited project files, the command creates a supply-chain risk because both the package resolved by `npx` and the repository contents can change after review.

### Attack Path

1. An attacker compromises the npm package, GitHub repository, release process, or a maintainer account.
2. The attacker publishes a modified package version or replaces repository content with malicious Skill instructions or another payload.
3. A user copies and executes the installation command from `README.md`.
4. `npx` resolves the unpinned package, and the installer retrieves the current mutable repository content.
5. The `--yes` option bypasses confirmation, and the content is installed globally.
6. Any malicious behavior supported by the compromised installer or installed content runs under the permissions of the invoking user.

### Impact Assessment

A compromised package or repository could alter globally installed Skill content and affect compatible agent sessions that load it. If the invoked package executes installation hooks or other code, c
...[truncated 266 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the skills CLI to an exact, audited version rather than allowing npx to resolve a mutable version.
2. Pin the GitHub source to a full commit SHA or use a signed, immutable release artifact.
3. Publish and verify a cryptographic checksum or signature for the Skill package.
4. Remove --yes so users can review the requested operation before installation.
5. Avoid --global unless global installation is operationally necessary; prefer a project-local or isolated installation.
6. Document the exact versions and commit reviewed by the security audit.
7. Re-audit and update integrity metadata whenever dependencies or Skill content change.

T08 · Insecure Dependencies

Warning

• Location: README.md:20

Finding

Execution of an Unpinned Latest Security-Scanner Package

Content

View full analysis

Vulnerability Details

File Location: README.md, lines 20–24
Vulnerability Type: Execution of a mutable third-party package
Risk Level: Medium

Vulnerable Code

markdown

## Security Scan

```bash
uvx snyk-agent-scan@latest --skills SKILL.md

text

### Technical Analysis

The documented scan command directs `uvx` to retrieve and execute `snyk-agent-scan@latest`. The `latest` selector is mutable and does not identify the specific package artifact covered by this audit. A later release can therefore introduce different code without any corresponding change to this repository.

Security tooling is not inherently trusted merely because it performs a scan. Running a remotely resolved package gives that package code execution within the invoking user's environment. Without an exact version, lockfile, hash, or signature verification, users cannot reliably establish that the executed artifact is the reviewed one.

### Attack Path

1. An attacker compromises the package registry entry, publisher account, release pipeline, or a transitive dependency.
2. A malicious package version is published and becomes the version selected by `latest`.
3. A user follows the README and runs the documented command.
4. `uvx` downloads the newly selected package and its dependencies.
5. The package executes locally as the invoking user.
6. Malicious package code can access resources available to that user and perform actions permitted in the execution environment.

### Impact Assessment

Successful exploitation could result in arbitrary code execution with the invoking user's privileges. Depending on the local environment and permissions, exposed resources could include files readable or writable by that user, environment variables, source code, and accessible network services. No evidence shows that the currently audited project performs such actions; the risk arises from executing an unpinned future package artifact.

Remediation

View remediation

Remediation Suggestions

1. Replace @latest with an exact, audited package version.
2. Use a lockfile or equivalent mechanism that pins all transitive dependencies.
3. Require hash or signature verification before executing the scanner.
4. Run the scanner in a sandbox or disposable container with minimal filesystem access, no unnecessary credentials, and restricted network permissions.
5. Review release notes and re-audit the package before upgrading.
6. In CI, grant the scanner only the repository read access and output permissions required for its task.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill explicitly says to trigger on ANY partnership, alliance, channel, ecosystem, supplier, or business development topic and even adds 'If in doubt, use this skill,' making invocation criteria far broader than necessary. This can cause the agent to activate the skill in loosely related contexts, increasing prompt-surface area, overshadowing more appropriate domain skills, and potentially steering outputs with irrelevant or risky instructions.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The README instructs users to execute npx skills directly from the registry without pinning an exact version. That allows whatever package version is current at install time to run code on the user's machine, so a compromised, malicious, or breaking upstream release could be executed implicitly. In a skill-installation context, this is more dangerous because users are explicitly encouraged to copy-paste the command as part of setup.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence

Finding

The security scan example runs uvx snyk-agent-scan@latest, which fetches and executes the latest published version rather than a fixed, reviewed release. Using @latest creates a supply-chain risk: a compromised or malicious new release could be executed immediately by anyone following the README. The fact that this appears in a security-related command does not reduce risk; it may increase trust and make users less cautious.

Content

No source excerpt is available for this finding.