Risk Management Playbook

• Outcome: Review
• Latest audit: Sep 11, 2026 · 9:28 AM UTC
• Version: 0.1.0

Overview

The skill content is a normal risk-management reference, but its README tells users to run unpinned remote install and scan commands, including a global install without confirmation.

Review the skill content as a risk-management reference, but do not run the README commands as written in sensitive environments. Prefer a pinned installer version, a pinned repository commit or release, project-local installation, and an interactive confirmation step; run any scanner from a pinned, trusted version in a restricted environment.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: README.md:17
• Finding: Unpinned npm Tool Executes a Mutable Global Skill Installation## Vulnerability Details **File Location**: `README.md:17` **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: Medium ```bash npx skills add https://github.com/Hey-Salad/risk-management-playbook-skill --skill risk-management-playbook --yes --global ``` ### Technical Analysis The documented installation command invokes the npm package `skills` through `npx` without specifying an exact package version. It also installs the Skill from a GitHub repository without pinning the source to an immutable commit hash or signed release. Consequently, both the installation tool and installed Skill content can change after this repository has been audited. The `--yes` option suppresses interactive confirmation, while `--global` installs the result into shared Agent state rather than limiting it to the current project. If the npm package, npm publisher account, GitHub repository, or maintainer account is compromised, a user following this instruction could install unreviewed content globally. No evidence indicates that the currently referenced package or repository is malicious. The finding concerns the unsafe, mutable supply-chain trust model created by the documented command. ### Attack Path 1. An attacker compromises the npm package, its publisher account, the referenced GitHub repository, or a maintainer account. 2. The attacker publishes a malicious package version or modifies the repository's default branch. 3. A user executes the command from `README.md`. 4. `npx` resolves and runs the unpinned npm package, which retrieves content from the mutable GitHub source. 5. The installation proceeds without confirmation because of `--yes`. 6. The altered Skill is installed globally and may subsequently influence every compatible Agent runtime that loads it. ### Impact Assessment A malicious npm installer could potentially execute code with the privileges of the invoking user, subject to the behavior and permissions o ...[truncated 537 chars]
• Remediation: ## Remediation Suggestions - Pin the npm tool to a reviewed exact version, such as `npx skills@<audited-version>`. - Pin the GitHub source to an immutable, reviewed commit hash or a signed release rather than its default branch. - Verify release signatures or published checksums before installation. - Remove `--yes` where practical so users can review the requested operation. - Prefer project-local installation. Use `--global` only when explicitly required and document the expanded trust scope. - Perform installation inside a sandbox with minimal filesystem, credential, and network access. - Periodically re-audit pinned versions before updating them.

T08 · Insecure Dependencies

Warning

• Location: README.md:23
• Finding: Security Scan Command Executes an Unpinned Latest Python Package## Vulnerability Details **File Location**: `README.md:23` **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: Medium ```bash uvx snyk-agent-scan@latest --skills SKILL.md ``` ### Technical Analysis The documented security-scan command instructs `uvx` to download and execute the `latest` release of `snyk-agent-scan`. The effective executable is not part of this repository and can change independently after the Skill has been audited. Using the mutable `latest` selector prevents reproducible verification and exposes users to package-account compromise, malicious future releases, or unexpected upstream changes. A security-scanning context can increase user trust in the command even though the retrieved package executes with the invoking user's permissions. No evidence indicates that the package's current release is malicious. The vulnerability is the unpinned execution of mutable third-party code. ### Attack Path 1. An attacker compromises the package registry entry, publisher account, release pipeline, or an upstream dependency used by `snyk-agent-scan`. 2. The attacker causes a malicious release to become the version resolved by `@latest`. 3. A user follows the documented security-scan instruction. 4. `uvx` downloads the attacker-controlled release and executes it locally. 5. The process can perform actions allowed by the invoking user's account before, during, or instead of scanning `SKILL.md`. ### Impact Assessment A compromised scanner package could execute arbitrary code within the invoking user's privilege boundary. Depending on the runtime environment and available permissions, this could expose project files, user-readable files, environment variables, tokens, Agent configuration, or network-accessible resources. It could also modify files or produce falsified scan results. The documented command does not request elevated privileges or establish persistence. Therefore, root access, system-wid ...[truncated 74 chars]
• Remediation: ## Remediation Suggestions - Replace `@latest` with an exact, reviewed package version. - Use a lockfile or equivalent dependency manifest that records exact transitive dependency versions. - Require package hash verification where supported. - Execute the scanner in an isolated environment with no unnecessary credentials, restricted filesystem mounts, and limited network access. - Review release provenance and signatures before updating the pinned version. - Document a controlled update process that includes security review and regression testing.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Vague Triggers

High

• Confidence: 98% confidence
• Finding: The activation criteria are extremely broad, including 'ANY risk management' topics and 'If in doubt, use this skill,' which can cause the agent to invoke this playbook in many loosely related contexts. Over-broad triggering can override more appropriate skills, increase prompt-surface exposure, and lead to irrelevant or conflicting guidance being injected into conversations where it is not needed.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence
• Finding: The README instructs users to execute `npx skills` directly from the registry without pinning an exact version. That allows whatever version is current at install time to run with the user's privileges, creating a supply-chain risk if the package is compromised, replaced, or updated with malicious behavior. In skill-installation context, this is more dangerous because users are being guided to execute a remote package as part of setup.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence
• Finding: The security scan command uses `uvx snyk-agent-scan@latest`, which fetches and executes the newest published package version at runtime. Using `@latest` for a security tool creates a direct supply-chain execution risk and can undermine reproducibility; if the package or publishing account is compromised, users may run attacker-controlled code while believing they are performing a security check. The reassuring 'Security Scan' framing makes this context slightly more dangerous because it may lower user suspicion.

Static analysis

No suspicious patterns detected.