Tech Data Playbook

• Outcome: Review
• Latest audit: Sep 11, 2026 · 9:28 AM UTC
• Version: 0.1.0

Overview

The skill itself is a coherent technology playbook, but its README uses unpinned commands that can execute changing third-party code and install the skill globally without confirmation.

Review the README install steps before using this skill. Prefer a pinned installer version, an immutable repository commit or release artifact, checksum/signature verification, and a project-local install without `--yes` unless global installation is intentional. The playbook content itself appears purpose-aligned and does not show hidden data access or destructive behavior.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: README.md:17
• Finding: Unpinned npm Package and Mutable Remote Skill Installation## Vulnerability Details **File Location**: `README.md`, line 17 **Vulnerability Type**: Unpinned third-party package and mutable Git repository installation **Risk Level**: Medium **Vulnerable Code**: ```bash npx skills add https://github.com/Hey-Salad/tech-data-playbook-skill --skill tech-data-playbook --yes --global ``` ### Technical Analysis The documented installation command executes the `skills` npm package through `npx` without specifying an audited package version. It also installs Skill content from a mutable GitHub repository URL without pinning a commit SHA or verifying an artifact checksum or signature. Consequently, the code executed and content installed when a user follows the documentation may differ from what was reviewed during this audit. The `--yes` option suppresses interactive confirmation, while `--global` expands the installation scope beyond the current project. This is a software supply-chain weakness rather than evidence that the currently reviewed repository contains an embedded malicious payload. ### Attack Path 1. An attacker compromises the npm package, its maintainer account, the GitHub repository, or an associated mutable branch. 2. The attacker publishes malicious package code or modifies the remote Skill content. 3. A user runs the installation command from the README. 4. `npx` resolves and executes the unpinned npm package in the user's security context. 5. The installer retrieves the mutable repository content and installs it globally. 6. Malicious installation logic can access resources available to the operating-system user, while malicious Skill instructions may affect subsequent compatible agent sessions. ### Impact Assessment Successful exploitation could execute arbitrary commands with the privileges of the user running `npx`. Potential effects include modification of user-accessible files, theft of credentials available to that process, installation of altered Skill co ...[truncated 309 chars]
• Remediation: ## Remediation Suggestions - Pin the `skills` npm package to a specific, reviewed version instead of allowing `npx` to resolve the current release. - Pin the GitHub source to an immutable commit SHA or signed release artifact. - Verify checksums, signatures, and repository ownership before installation. - Remove `--yes` so users can inspect and approve installation actions. - Prefer a project-local installation over `--global` unless global installation is strictly required. - Run installation in a sandbox or least-privileged environment. - Document the expected package version, repository commit, artifact digest, and verification procedure. - Continuously monitor the npm package and repository for ownership changes or unauthorized releases.

T08 · Insecure Dependencies

Warning

• Location: README.md:23
• Finding: Execution of Mutable Latest Security Scanner Release## Vulnerability Details **File Location**: `README.md`, line 23 **Vulnerability Type**: Unpinned third-party scanner execution **Risk Level**: Medium **Vulnerable Code**: ```bash uvx snyk-agent-scan@latest --skills SKILL.md ``` ### Technical Analysis The security-scan command directs `uvx` to retrieve and execute the mutable `latest` release of `snyk-agent-scan`. No fixed version, package hash, lockfile, signature verification, or trusted artifact digest is specified. A security tool executes code locally and may receive access to repository files and environment resources. If a future release or package-publishing account is compromised, the command can execute code that was not included in the audited project and was not reviewed by the user. Although `uvx` generally creates an isolated package environment, that dependency isolation does not by itself sandbox the resulting process from user-accessible files, environment variables, or network resources. ### Attack Path 1. An attacker compromises the scanner package, its publishing account, or its upstream release process. 2. A malicious version becomes the package release identified by `latest`. 3. A user follows the README and runs the scan command. 4. `uvx` downloads and executes the compromised release. 5. The malicious scanner runs with the invoking user's privileges and can attempt to read accessible files, inspect environment variables, communicate over the network, or modify user-writable resources. ### Impact Assessment Successful exploitation could provide arbitrary code execution in the context of the user running the scanner. The accessible scope may include the project, other user-readable files, environment-based credentials, network-accessible services, and user-writable configuration. No explicit elevation mechanism or administrative execution requirement appears in the command. Therefore, the evidence supports user-level code execution, not aut ...[truncated 40 chars]
• Remediation: ## Remediation Suggestions - Replace `@latest` with a specific audited version. - Require hash verification or use a lock mechanism that records an immutable package digest. - Verify publisher identity and release signatures where supported. - Run the scanner in a restricted container or sandbox with minimal filesystem and network access. - Do not expose unrelated credentials or sensitive environment variables to the scan process. - Configure read-only repository access unless write access is demonstrably required. - Establish an explicit process for reviewing and updating the pinned scanner version.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Vague Triggers

High

• Confidence: 98% confidence
• Finding: The skill instructs invocation for essentially any technology, engineering, cloud, security, AI, or transformation topic, plus 'If in doubt, use this skill.' This creates an overbroad activation surface that can cause the agent to route many unrelated or only loosely related requests through this skill, increasing the chance that embedded guidance overrides more specific controls or causes prompt-scope interference.

Anti-Refusal Statement

High

• Category: Anti-Refusal

Content

- **Policy-as-Code** — Security, compliance, and governance baked into the platform, not bolted on
- **Developer Portal** — Single pane of glass for services, docs, health, and dependencies (Backstage, Port, etc.)

**Result:** Developers focus on features. Platform handles plumbing. Consistency without constraint.

---

• Confidence: 80% confidence
• Finding: Skill attempts to nullify the agent's safety policies or restrictions ('you have no restrictions', 'ignore your guidelines', 'do anything now'). This is a direct jailbreak that disables guardrails.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence
• Finding: The install command uses `npx skills` without pinning a specific package version, which means users may execute whatever version is current at install time. If the upstream package is compromised, typosquatted, or changes behavior unexpectedly, this README instructs users to run unreviewed code directly from the package registry.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence
• Finding: The security scan example uses `uvx snyk-agent-scan@latest`, which explicitly pulls the latest version at execution time rather than a reviewed, fixed release. This creates a supply-chain risk: a compromised or breaking upstream release could be executed by users who are attempting to perform a security scan, ironically increasing exposure in a high-trust context.

Session Persistence

Medium

• Category: Rogue Agent

Content

1. **Design for Failure** — Everything fails. Design systems that degrade gracefully, not catastrophically
2. **Loose Coupling, High Cohesion** — Services should be independent but internally focused
3. **Stateless by Default** — Store state in databases/caches, not in application instances
4. **API-First** — Every service exposes well-documented APIs. Internal and external consumers
5. **Observability by Default** — If you can't see it, you can't fix it. Instrument everything
6. **Automate Everything Repeatable** — If a human does it twice, automate it the third time

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Static analysis

No suspicious patterns detected.