Md Of Programer

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:21 AM UTC
• Version: 0.1.0

Overview

The skill does what it claims, but it may activate on broad diagram requests and can install an unpinned global npm package without clear user confirmation.

Review before installing. This skill is not showing deception or exfiltration, but you should only use it where you are comfortable allowing Bash commands, local Markdown edits, and persistent global tool installation. Prefer installing and pinning mddoc-cli yourself in a project-local environment before invoking the skill.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:22

Finding

Unpinned Global npm Package Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 22–26
Vulnerability Type: Unverified and unpinned third-party dependency installation
Risk Level: Medium

markdown

If `mddoc` is not installed:

```bash
npm install -g mddoc-cli

text

### Technical Analysis

The Skill instructs the agent to install the latest available version of `mddoc-cli` globally when the `mddoc` executable is unavailable. The package version and integrity are not pinned or verified.

An npm installation may execute package lifecycle scripts with the privileges of the invoking user. Because the installation is global, it also modifies the user's system-wide Node.js executable environment rather than containing the dependency within the project. Consequently, a compromised or malicious future release of `mddoc-cli`, or one of its transitive dependencies, could execute arbitrary commands during installation and expose a different effective payload than the version originally reviewed.

The audit found no evidence that the current package is malicious. The vulnerability is the unsafe dependency acquisition and installation process.

### Attack Path

1. An attacker compromises the `mddoc-cli` package, its publishing account, or a transitive dependency and publishes a malicious release.
2. A user invokes this Skill on a system where the `mddoc` executable is unavailable.
3. Following the Skill instructions, the agent runs `npm install -g mddoc-cli`.
4. npm retrieves the current package release and its dependencies without enforcing an audited version or expected integrity value.
5. Malicious package lifecycle code executes with the permissions of the user running the agent.
6. The malicious release may access user-readable files, modify user-writable files, make network connections, or install or replace globally available Node.js commands.

### Impact Assessment

Successful exploitation could provide arbitrary code execution wi
...[truncated 537 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin mddoc-cli to a specifically reviewed version rather than installing the latest release:

   bash

   npm install --save-dev --ignore-scripts mddoc-cli@<reviewed-version>
   

2. Prefer a project-local dependency over a global installation, and invoke it through a controlled package script or an explicitly resolved local binary.
3. Commit and enforce a lockfile with integrity hashes. Use npm ci in automated environments so dependency resolution cannot silently drift.
4. Disable npm lifecycle scripts with --ignore-scripts unless the reviewed package demonstrably requires them. If scripts are required, inspect them and execute installation in a sandbox with minimal filesystem, credential, and network access.
5. Require explicit user approval before installing missing software or modifying the user's executable environment.
6. Document the expected package publisher and official registry source, and configure npm to use an approved registry.
7. Run package provenance, signature, vulnerability, and integrity checks before installation.
8. Fail safely when the dependency is missing instead of automatically installing an unreviewed release.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger phrases include very generic terms such as "mind map" and especially "diagram," which can match many ordinary user requests unrelated to this skill’s intended scope. This can cause the skill to activate unexpectedly and gain access to Read/Write/Bash capabilities in contexts where the user did not explicitly intend to invoke it, increasing the chance of unintended file modification or command execution.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.