Security checks for vulnerabilities and agentic risk
Overview
The skill is mostly a disclosed Model Studio crawl/report helper, but it asks users to run an unpinned remote npm package with broad local execution rights and overstates skill-generation behavior.
Review before installing. Use only in a constrained workspace, pin or vendor the crawler dependency before running it, and do not rely on it to modify or regenerate installed skills unless that behavior is separately implemented and reviewed.
The documented workflow invokes npx with the -y option and an unversioned third-party npm package. This causes npm to resolve the package version from the configured registry, download it when necessary, and execute it without an interactive confirmation prompt.
Because neither an exact version nor an integrity value is specified, the code executed by this command can change after the Skill has been reviewed. A malicious or compromised future release of @just-every/crawl, one of its transitive dependencies, or the relevant registry delivery path could therefore result in arbitrary local code execution.
This is classified as T08: Insecure Dependencies rather than confirmed embedded malicious code because the repository does not contain evidence that the current package is malicious. The vulnerability is the unsafe, mutable dependency execution mechanism.
Attack Path
An attacker compromises the npm package, its maintainer account, a transitive dependency, or the package distribution path.
The attacker publishes or serves a malicious version that is selected by unversioned npm resolution.
A user follows the workflow in SKILL.md.
npx -y downloads the selected package and suppresses the installation confirmation.
npm executes package or lifecycle code under the invoking user's account.
The malicious code can access resources available to that account and alter files or execute additional processes.
Impact Assessment
Successful exploitation provides arbitrary code execution with the privileges of the user running the workflow. The accessible scope may include t
...[truncated 410 chars]
Remediation
View remediation
Remediation Suggestions
Pin @just-every/crawl to an audited exact version rather than allowing mutable latest-version resolution.
Declare the package in a dedicated package.json and commit a lockfile containing resolved versions and integrity hashes.
Install dependencies in a separate, reviewable step using a lockfile-enforcing command such as npm ci.
Avoid automatic confirmation flags for ad hoc remote package execution. Invoke the locally installed, pinned executable instead.
Review the package and its transitive dependency tree before upgrades, and use automated dependency and provenance checks where available.
Run the crawler with minimal filesystem, credential, and network access, preferably inside an isolated container or sandbox.
A hardened workflow could take the following form:
bash
npm ci --ignore-scripts
./node_modules/.bin/crawl "https://help.aliyun.com/zh/model-studio/models" \
> alicloud-model-studio-models.md
If the package requires lifecycle scripts, review them explicitly before removing --ignore-scripts.
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (7)
Tp4
High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding
The declared description suggests an end-to-end refresh/update tool that refreshes the Model Studio model crawl and regenerates summaries and skills. The supplied code only consumes a preexisting output/alicloud-model-studio-models.json file, classifies entries by keyword, and emits output/alicloud-model-studio-skill-scan.md with coverage suggestions and counts. Its actual role is a scan/report helper dependent on prior data generation ('Run refresh_models_summary.py first'), not the refresh or regeneration mechanism itself. Therefore the description materially overstates and mischaracterizes the code's primary purpose.
Content
No source excerpt is available for this finding.
Tp4
High
Category
MCP Tool Poisoning
Confidence
91% confidence
Finding
The code is consistent with part of the description: it processes the Model Studio crawl and regenerates derived summary artifacts. However, the declared purpose also says it should regenerate skills/ai/** skills, and this code does not read, write, or update any skill files. Its actual scope is limited to producing two output summary files from an existing markdown input. That makes the description materially broader than the behavior shown in this code chunk.
Content
No source excerpt is available for this finding.
Undeclared Tool Scope
Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding
The skill instructs the agent to perform network access, read files, and write generated artifacts, but it declares no explicit tool scope or permission boundaries. In an agentic environment, this increases the blast radius of prompt misuse or accidental overreach because the runtime may grant broader capabilities than the skill actually needs.
Content
No source excerpt is available for this finding.
Rp1
Medium
Category
MCP Rug Pull
Confidence
97% confidence
Finding
Using npx -y @just-every/crawl without a pinned version causes the skill to fetch and execute whatever package version is current at runtime. This creates a supply-chain execution risk: a compromised upstream package, typo-squatted dependency, or malicious new release could run arbitrary code with the skill's network and filesystem access.
Content
No source excerpt is available for this finding.
Description-Behavior Mismatch
Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding
The manifest presents the skill as a broad 'AI misc' capability, while the stated purpose is narrowly limited to Model Studio model crawling and regenerating related skills. This scope mismatch can cause an agent or operator to invoke the skill for tasks outside its intended boundary, increasing the chance of overbroad actions, unsafe automation, or misuse of crawl/refresh workflows.
Content
No source excerpt is available for this finding.
Rp1
Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content
No source excerpt is available for this finding.
Natural-Language Policy Violations
Low
Category
Not specified by scanner
Confidence
91% confidence
Finding
The generated report headings and labels are hard-coded in Chinese, such as "技能覆盖扫描", "覆盖建议", and "未分类模型". This imposes a specific language on output without any user opt-in or documented justification, which fits the locale-policy violation category.
