Tech Data Playbook

• Outcome: Review
• Latest audit: Sep 11, 2026 · 9:28 AM UTC
• Version: 0.1.0

Overview

The skill itself is a coherent technology playbook, but its README uses unpinned commands that can execute changing third-party code and install the skill globally without confirmation.

Review the README install steps before using this skill. Prefer a pinned installer version, an immutable repository commit or release artifact, checksum/signature verification, and a project-local install without `--yes` unless global installation is intentional. The playbook content itself appears purpose-aligned and does not show hidden data access or destructive behavior.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: README.md:17

Finding

Unpinned npm Package and Mutable Remote Skill Installation

Content

View full analysis

Vulnerability Details

File Location: README.md, line 17
Vulnerability Type: Unpinned third-party package and mutable Git repository installation
Risk Level: Medium

Vulnerable Code:

bash

npx skills add https://github.com/Hey-Salad/tech-data-playbook-skill --skill tech-data-playbook --yes --global

Technical Analysis

The documented installation command executes the skills npm package through npx without specifying an audited package version. It also installs Skill content from a mutable GitHub repository URL without pinning a commit SHA or verifying an artifact checksum or signature.

Consequently, the code executed and content installed when a user follows the documentation may differ from what was reviewed during this audit. The --yes option suppresses interactive confirmation, while --global expands the installation scope beyond the current project.

This is a software supply-chain weakness rather than evidence that the currently reviewed repository contains an embedded malicious payload.

Attack Path

1. An attacker compromises the npm package, its maintainer account, the GitHub repository, or an associated mutable branch.
2. The attacker publishes malicious package code or modifies the remote Skill content.
3. A user runs the installation command from the README.
4. npx resolves and executes the unpinned npm package in the user's security context.
5. The installer retrieves the mutable repository content and installs it globally.
6. Malicious installation logic can access resources available to the operating-system user, while malicious Skill instructions may affect subsequent compatible agent sessions.

Impact Assessment

Successful exploitation could execute arbitrary commands with the privileges of the user running npx. Potential effects include modification of user-accessible files, theft of credentials available to that process, installation of altered Skill co ...[truncated 309 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the skills npm package to a specific, reviewed version instead of allowing npx to resolve the current release.
• Pin the GitHub source to an immutable commit SHA or signed release artifact.
• Verify checksums, signatures, and repository ownership before installation.
• Remove --yes so users can inspect and approve installation actions.
• Prefer a project-local installation over --global unless global installation is strictly required.
• Run installation in a sandbox or least-privileged environment.
• Document the expected package version, repository commit, artifact digest, and verification procedure.
• Continuously monitor the npm package and repository for ownership changes or unauthorized releases.

T08 · Insecure Dependencies

Warning

• Location: README.md:23

Finding

Execution of Mutable Latest Security Scanner Release

Content

View full analysis

Vulnerability Details

File Location: README.md, line 23
Vulnerability Type: Unpinned third-party scanner execution
Risk Level: Medium

Vulnerable Code:

bash

uvx snyk-agent-scan@latest --skills SKILL.md

Technical Analysis

The security-scan command directs uvx to retrieve and execute the mutable latest release of snyk-agent-scan. No fixed version, package hash, lockfile, signature verification, or trusted artifact digest is specified.

A security tool executes code locally and may receive access to repository files and environment resources. If a future release or package-publishing account is compromised, the command can execute code that was not included in the audited project and was not reviewed by the user.

Although uvx generally creates an isolated package environment, that dependency isolation does not by itself sandbox the resulting process from user-accessible files, environment variables, or network resources.

Attack Path

1. An attacker compromises the scanner package, its publishing account, or its upstream release process.
2. A malicious version becomes the package release identified by latest.
3. A user follows the README and runs the scan command.
4. uvx downloads and executes the compromised release.
5. The malicious scanner runs with the invoking user's privileges and can attempt to read accessible files, inspect environment variables, communicate over the network, or modify user-writable resources.

Impact Assessment

Successful exploitation could provide arbitrary code execution in the context of the user running the scanner. The accessible scope may include the project, other user-readable files, environment-based credentials, network-accessible services, and user-writable configuration.

No explicit elevation mechanism or administrative execution requirement appears in the command. Therefore, the evidence supports user-level code execution, not aut ...[truncated 40 chars]

Remediation

View remediation

Remediation Suggestions

• Replace @latest with a specific audited version.
• Require hash verification or use a lock mechanism that records an immutable package digest.
• Verify publisher identity and release signatures where supported.
• Run the scanner in a restricted container or sandbox with minimal filesystem and network access.
• Do not expose unrelated credentials or sensitive environment variables to the scan process.
• Configure read-only repository access unless write access is demonstrably required.
• Establish an explicit process for reviewing and updating the pinned scanner version.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill instructs invocation for essentially any technology, engineering, cloud, security, AI, or transformation topic, plus 'If in doubt, use this skill.' This creates an overbroad activation surface that can cause the agent to route many unrelated or only loosely related requests through this skill, increasing the chance that embedded guidance overrides more specific controls or causes prompt-scope interference.

Content

No source excerpt is available for this finding.

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 80% confidence

Finding

Skill attempts to nullify the agent's safety policies or restrictions ('you have no restrictions', 'ignore your guidelines', 'do anything now'). This is a direct jailbreak that disables guardrails.

Content

Scanner excerpt · SKILL.md (reported line 97)May include surrounding context.

md

- **Policy-as-Code** — Security, compliance, and governance baked into the platform, not bolted on
- **Developer Portal** — Single pane of glass for services, docs, health, and dependencies (Backstage, Port, etc.)

**Result:** Developers focus on features. Platform handles plumbing. Consistency without constraint.

---

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

The install command uses npx skills without pinning a specific package version, which means users may execute whatever version is current at install time. If the upstream package is compromised, typosquatted, or changes behavior unexpectedly, this README instructs users to run unreviewed code directly from the package registry.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The security scan example uses uvx snyk-agent-scan@latest, which explicitly pulls the latest version at execution time rather than a reviewed, fixed release. This creates a supply-chain risk: a compromised or breaking upstream release could be executed by users who are attempting to perform a security scan, ironically increasing exposure in a high-trust context.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 370)May include surrounding context.

md

1. **Design for Failure** — Everything fails. Design systems that degrade gracefully, not catastrophically
2. **Loose Coupling, High Cohesion** — Services should be independent but internally focused
3. **Stateless by Default** — Store state in databases/caches, not in application instances
4. **API-First** — Every service exposes well-documented APIs. Internal and external consumers
5. **Observability by Default** — If you can't see it, you can't fix it. Instrument everything
6. **Automate Everything Repeatable** — If a human does it twice, automate it the third time