Effector FSD

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 10:00 AM UTC
• Version: 0.6.0

Overview

This is a documentation-only architecture guidance skill; the main caution is that some optional tooling examples use unpinned npm/npx commands.

Before following the optional Steiger setup snippets, pin exact package versions, commit a lockfile, and run the local pinned binary rather than allowing npx to resolve mutable packages. The skill otherwise reads as ordinary architecture guidance.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: references/10-tooling.md:22

Finding

Unpinned Third-Party Development Tools Are Installed and Executed

Content

View full analysis

Vulnerability Details

File Location: references/10-tooling.md:22-29
Vulnerability Type: Unpinned npm dependencies and execution of mutable third-party packages
Risk Level: Medium

Vulnerable Code

bash

npm i -D steiger @feature-sliced/steiger-plugin

bash

npx steiger ./src
npx steiger ./src --watch

Technical Analysis

The documented installation command does not specify exact versions for steiger or @feature-sliced/steiger-plugin. It therefore resolves mutable package versions at installation time. The subsequent npx commands execute the installed tooling against the project source tree.

npm package installation may also execute package lifecycle scripts. If a package, dependency, maintainer account, or newly published release is compromised, following these instructions could execute attacker-controlled code with the privileges of the developer or CI account. This conflicts with the same document's recommendation to pin versions.

Attack Path

1. An attacker compromises one of the named packages, a transitive dependency, or its publishing account.
2. The attacker publishes a malicious version selected by npm's unconstrained version resolution.
3. A developer or CI job follows the documented npm i -D command.
4. Malicious code runs through an installation lifecycle script or when npx steiger invokes the installed executable.
5. The code operates with the invoking account's permissions and can access resources available to that process.

Impact Assessment

Successful exploitation could read or modify the checked-out repository and files accessible to the invoking user. In CI, the potential scope may include environment variables, build artifacts, package-registry credentials, or other secrets exposed to the job. The commands do not request elevated operating-system privileges, so impact remains bounded by the developer or CI account's existing permissions.

Remediation

View remediation

Remediation Suggestions

• Replace unconstrained package names with reviewed, exact versions.
• Commit and review the generated lockfile.
• Use npm ci in CI to enforce lockfile-resolved dependency integrity.
• Configure automated dependency updates to require review and security checks.
• Consider disabling lifecycle scripts with --ignore-scripts where compatible, then explicitly run only required trusted setup steps.
• Ensure npx does not download an undeclared package dynamically; execute the lockfile-installed binary through a pinned package script.
• Apply the same changes to the duplicate commands in references/09-migration-playbook.md:188-189.

T08 · Insecure Dependencies

Warning

• Location: references/09-migration-playbook.md:188

Finding

Migration Instructions Repeat Unpinned Package Installation and Execution

Content

View full analysis

Vulnerability Details

File Location: references/09-migration-playbook.md:188-189
Vulnerability Type: Unpinned npm dependencies and execution of mutable third-party tooling
Risk Level: Medium

Vulnerable Code

bash

npm i -D steiger @feature-sliced/steiger-plugin
npx steiger ./src

Technical Analysis

The migration playbook independently directs users to install packages without exact versions and immediately execute the resulting CLI. Dependency resolution can consequently select package releases that were not present when the Skill was audited. Installation lifecycle scripts and the CLI itself execute locally, creating a supply-chain execution boundary.

Attack Path

1. A malicious or compromised release enters the dependency graph.
2. A user performs the migration and runs the documented installation command.
3. npm resolves and installs the compromised release.
4. Attacker-controlled code executes during installation or through npx steiger.
5. The payload gains access to files, credentials, and environment data available to the invoking process.

Impact Assessment

The potential scope includes source-code theft or modification, tampering with build output, and exposure of developer or CI secrets. No explicit privilege-escalation mechanism is present; access is limited to the permissions and credentials already available to the npm process.

Remediation

View remediation

Remediation Suggestions

• Pin both packages to reviewed exact versions.
• Use a committed lockfile and npm ci.
• Invoke the pinned local binary through a package script.
• Add dependency integrity and provenance checks to CI.
• Keep this playbook synchronized with the hardened commands in references/10-tooling.md.

SkillSpector

Vulnerability Patterns

• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The session entity example exports sessionDropped from entities/session/index.ts at L065, but the redirects example imports and relies on sessionCleared at L172 and the prose at L205 describes redirect behavior on sessionCleared. This is an active contradiction between the file's own documented API surface and later example code, which can mislead implementers about the intended event name and wiring.

Content

No source excerpt is available for this finding.