focus-coach

• Outcome: Review
• Latest audit: Sep 11, 2026 · 2:08 AM UTC
• Version: 1.0.0

Overview

This focus-coaching skill is purpose-aligned, but it asks users to install and authenticate a third-party payment CLI and may route broad focus-related conversations to a paid external API.

Review this before installing. Use it only if you are comfortable installing and authenticating the awal npm CLI, sending focus-related prompts to the listed external API, and paying per request. Prefer a constrained environment and a low-limit payment identity; do not route private or sensitive situations through it unless you trust the endpoint and CLI.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:17

Finding

Execution of an Unreviewed Third-Party npm CLI

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 17–24
Vulnerability Type: Third-party dependency and supply-chain risk
Risk Level: Medium

Vulnerable Code

bash

npm install -g awal@2.0.3
awal auth login

bash

npx awal@2.0.3 x402 pay https://anicca-proxy-production.up.railway.app/api/x402/focus-coach \
  -X POST \
  -d '{"situation":"I need to write a report but keep getting distracted by my phone","energy_level":"medium","language":"en"}'

Technical Analysis

The skill instructs users to download, globally install, and execute the third-party awal@2.0.3 npm package. npm installations can execute package lifecycle scripts, and a global installation increases the affected scope. The package is subsequently invoked through npx, creating another package-resolution and execution path.

Although the dependency is pinned to a version, the project provides no lockfile, package integrity hash, vendored source, or reviewed implementation from which the downloaded artifact's behavior can be verified. Consequently, the audited SKILL.md does not establish that the npm artifact or its transitive dependencies are trustworthy. This finding identifies an insecure dependency-execution pattern; the available evidence does not establish that awal@2.0.3 is itself malicious.

Attack Path

1. A user follows the prerequisite documented in SKILL.md.
2. npm resolves and downloads awal@2.0.3 and its transitive dependencies from the configured registry.
3. npm may execute lifecycle scripts during the global installation.
4. The user authenticates through awal auth login, exposing authentication or payment-related data to the installed CLI according to its implementation.
5. The usage command invokes the package again through npx and initiates a paid blockchain request.
6. If the package artifact, a transitive dependency, the registry, or the package publisher account were compromis ...[truncated 713 chars]

Remediation

View remediation

Remediation Suggestions

• Avoid global package installation. Use a project-local, reviewed dependency executed from a controlled environment.
• Commit a lockfile and use a clean, reproducible installation command such as npm ci.
• Verify package provenance and document the authoritative publisher and repository.
• Validate the exact package artifact with registry integrity metadata or an independently verified cryptographic digest.
• Audit the package's source, lifecycle scripts, and transitive dependency tree before recommending execution.
• Disable lifecycle scripts with --ignore-scripts when the package does not require them.
• Remove the redundant npx resolution path and invoke only the locally installed, verified binary.
• Run the CLI in a sandbox or container with minimal filesystem, environment-variable, credential, wallet, and network access.
• Use a dedicated low-value wallet or payment identity with strict spending limits for x402 requests.
• Document what authentication data and user-submitted content the CLI and remote endpoint can access, including retention and privacy behavior.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill's trigger list and usage description include very common terms such as 'focus', 'productivity', 'attention', and 'distracted', which are likely to match many ordinary conversations. Overly broad routing can cause the skill to activate in contexts where it is not specifically requested, leading to unnecessary external API calls and unintended sharing of user-provided text with a third-party service.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.