Sustainability Playbook

• Outcome: Review
• Latest audit: Sep 11, 2026 · 9:28 AM UTC
• Version: 0.1.0

Overview

The skill content is a coherent ESG guidance playbook, but its install and scan instructions ask users to run mutable, unpinned remote packages with global/noninteractive installation.

Review the README commands before installing. Prefer pinning the skills installer, pinning the GitHub source to a reviewed commit, avoiding --yes and --global unless you really need global availability, and running any third-party scanner in an isolated environment with no unnecessary secrets. The ESG playbook content itself appears domain-aligned, but regulatory guidance should be checked against current official sources before relying on it.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: README.md:16

Finding

Unpinned Package and Mutable Repository Used for Global Skill Installation

Content

View full analysis

Vulnerability Details

File Location: README.md, lines 16–17
Vulnerability Type: Unpinned third-party dependency and mutable remote source
Risk Level: Medium

bash

npx skills add https://github.com/Hey-Salad/sustainability-playbook-skill --skill sustainability-playbook --yes --global

Technical Analysis

The installation instructions invoke the skills package through npx without specifying a package version. This allows the package manager to retrieve and execute whichever release is current when the command is run. The skill itself is also retrieved from a GitHub URL that is not pinned to a reviewed commit SHA or signed release.

The --yes option suppresses interactive confirmation, while --global expands the installation scope beyond the current project. The effective code and content executed or installed by this command can therefore change after the audited revision has been reviewed.

This is a supply-chain risk rather than evidence that the current repository is malicious. Exploitation requires compromise or malicious modification of the package, package publisher, upstream repository, or referenced default branch.

Attack Path

1. An attacker compromises the package publishing account, the skills package, the GitHub account, or the upstream repository.
2. The attacker publishes a malicious package release or modifies content reachable through the mutable repository URL.
3. A user follows the documented installation command.
4. npx downloads and executes the current unpinned package, which then retrieves the mutable repository content.
5. Malicious package entry-point or lifecycle logic executes with the invoking user's permissions.
6. The global, non-interactive installation may place attacker-controlled content outside the current project and make it available to future agent sessions.

Impact Assessment

A compromised dependency could execute arbitrary commands with th ...[truncated 484 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the skills package to a specific reviewed version rather than allowing npx to resolve the current release.
• Pin the GitHub source to an immutable, reviewed commit SHA or a cryptographically signed release.
• Verify release signatures or published checksums before installation.
• Remove --global unless global installation is operationally necessary; prefer a project-local installation with minimal permissions.
• Avoid --yes for security-sensitive installation workflows so users can inspect the resolved package and destination.
• Use a lockfile or an internally mirrored and approved package artifact where possible.
• Document the exact package version, repository revision, expected files, and verification procedure.
• Run installation from an unprivileged account and, where practical, inside an isolated environment.

T08 · Insecure Dependencies

Warning

• Location: README.md:22

Finding

Security Scanner Executed from an Unpinned Latest Release

Content

View full analysis

Vulnerability Details

File Location: README.md, lines 22–23
Vulnerability Type: Execution of a mutable third-party package release
Risk Level: Medium

bash

uvx snyk-agent-scan@latest --skills SKILL.md

Technical Analysis

The command directs uvx to download and execute snyk-agent-scan@latest. The @latest selector is mutable and may resolve to a different package version each time the command is run. As a result, the scanner code that receives local access to SKILL.md is not necessarily the version reviewed when these instructions were written.

Package execution occurs as part of the scan command. If the package distribution channel or publisher is compromised, malicious code can run before or instead of the expected scanner behavior. Describing the command as a security scan does not provide isolation or make the retrieved package intrinsically trustworthy.

No evidence was found that the currently referenced package is malicious. The risk arises from executing an unpinned remote dependency.

Attack Path

1. An attacker compromises the package publisher, registry account, release pipeline, or package distribution infrastructure.
2. The attacker causes the latest release to contain malicious initialization or scanner code.
3. A user runs the security scan command from the project documentation.
4. uvx resolves @latest, downloads the compromised release, and executes it.
5. The malicious process reads or changes resources available to the invoking user and may return fabricated scan results to conceal its behavior.

Impact Assessment

Successful exploitation could provide arbitrary code execution with the invoking user's permissions. The malicious package could access the project, environment variables, user-readable credentials, configuration files, network services, and other files available to that account. It could also alter project content or produce misleading security re ...[truncated 181 chars]

Remediation

View remediation

Remediation Suggestions

• Replace @latest with a specific, reviewed package version.
• Where supported, require a package hash, signed artifact, or locked dependency resolution.
• Record the approved version and integrity information in project-controlled configuration.
• Upgrade scanner versions through an explicit review process rather than automatic latest-version resolution.
• Run third-party scanners in a sandbox or isolated CI job with read-only project access, restricted network access, no unnecessary secrets, and an unprivileged account.
• Review package provenance and publisher ownership before approving upgrades.
• Avoid exposing unrelated repository files, credentials, or environment variables to the scanning process.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill explicitly says to trigger on ANY sustainability-, ESG-, climate-, or responsible-business-related discussion and even instructs 'If in doubt, use this skill.' This broad routing criterion can cause over-invocation, making the agent defer to this skill in marginal or unrelated contexts, which increases the chance of inappropriate guidance, context hijacking, or suppression of better-suited skills.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence

Finding

The README instructs users to execute npx skills directly from the registry without pinning an exact package version. This creates a supply-chain risk because a later malicious or compromised release could be fetched and executed automatically on the user's system during installation.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The security-scan command uses uvx snyk-agent-scan@latest, which explicitly pulls the latest release at execution time. Even though this is framed as a security tool, using @latest still introduces code-execution risk from an unpinned upstream package, and security-themed context can make users less suspicious and more likely to run it.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.