Dependency Update Checker

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 1:16 AM UTC
• Version: 1.0.1

Overview

This skill is a disclosed, check-only dependency update tool that runs expected package-manager commands without hidden persistence or data-modifying behavior.

Install this only if you are comfortable letting it run npm, pip, or poetry outdated-check commands in the project directory you choose. In private-registry environments, those tools may use existing registry configuration and reveal package metadata to configured registries, though the skill does not update or delete dependencies.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill advertises execution of local package-manager commands and directory-based dependency inspection, which implies shell and file-read capabilities, but it does not declare any explicit tool scope such as permissions or allowed-tools. This creates a trust and containment gap: an agent may invoke shell/file access without clear least-privilege constraints, increasing the chance of unintended command execution in sensitive directories or against attacker-controlled project files.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

def check_command_exists(cmd: str) -> bool:
    """Check if a command exists in PATH."""
    try:
        subprocess.run(["which", cmd], capture_output=True, check=True)
        return True
    except subprocess.CalledProcessError:
        return False

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

"""Run a command and return standardized result."""
    start_time = time.time()
    try:
        result = subprocess.run(
            cmd,
            capture_output=True,
            text=True,

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Missing User Warnings

Low

• Confidence: 88% confidence
• Finding: The README instructs users to run `npm outdated`, `pip list --outdated`, and `poetry show --outdated`, which typically contact remote package registries. In environments with configured credentials or private registries, these commands may disclose repository usage patterns or use existing authentication context without the README clearly warning users about that network behavior.