Daily Devotion

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:00 AM UTC
• Version: 1.1.1

Overview

This devotional skill is not clearly malicious, but it asks users to run unpinned npm/npx code that was not included in the reviewed artifact.

Review the npm package source and pin exact versions before using the install or npx commands. If you only need the devotion, prefer having the agent fetch the documented OurManna URL directly and avoid sharing sensitive prayer details unless necessary.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:24

Finding

Unpinned and Unreviewable Third-Party Package Execution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 24-32 and 57-59
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

The Skill instructs users to install or directly execute mutable npm registry packages:

bash

npm install daily-devotion-skill

bash

npx daily-devotion-skill

It also recommends executing a TypeScript helper through npx:

bash

npx ts-node scripts/fetch_verse.ts

Technical Analysis

The audited project contains only SKILL.md. It does not include the referenced helper script, npm package source, dependency manifest, lockfile, integrity hashes, or an exact package version. Consequently, the code that these commands install or execute cannot be verified from the reviewed artifact.

The package references are unpinned, so npm may resolve a different version after the Skill has been reviewed. In particular, npx daily-devotion-skill can download and immediately execute registry-hosted code. The npx ts-node command may similarly obtain an unavailable runner dynamically, while the referenced scripts/fetch_verse.ts file is absent from this project.

Installation can also trigger npm lifecycle scripts. This creates a supply-chain execution boundary in which a compromised maintainer account, malicious package release, package-name takeover, or compromised transitive dependency could introduce arbitrary code without changing SKILL.md.

No evidence establishes that the named packages are currently malicious. The vulnerability is the Skill's reliance on mutable, unpinned, and unauditable third-party executable content.

Attack Path

1. An attacker compromises the npm package, its maintainer account, or a transitive dependency and publishes a malicious version.
2. The user follows the Skill instructions and runs npm install daily-devotion-skill, npx daily-devotion-skill, or the applicable npx ts-node command.
3. npm resolves the unpin ...[truncated 1173 chars]

Remediation

View remediation

Remediation Suggestions

1. Include all helper source code in the reviewed Skill package rather than requiring runtime retrieval of unaudited executable content.
2. Add a dependency manifest and lockfile containing exact versions and integrity metadata.
3. Replace unversioned package references with exact, reviewed versions. Do not use broad ranges or mutable tags such as latest.
4. Avoid runtime npx downloads. Install reviewed dependencies during a controlled build step and invoke the pinned local binary, such as ./node_modules/.bin/ts-node.
5. Use npm ci with a committed lockfile so dependency resolution is reproducible.
6. Disable dependency lifecycle scripts where they are unnecessary, for example by using npm ci --ignore-scripts, after confirming that reviewed dependencies do not require them.
7. Verify package provenance, registry identity, checksums, maintainers, and transitive dependencies before distribution.
8. Run helper code in a restricted environment with minimal filesystem access, no unnecessary credentials, and network access limited to the documented OurManna HTTPS endpoint.
9. Prefer having the host agent perform the documented fixed HTTPS GET directly, which removes the need to execute an external npm helper for this functionality.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The skill instructs users to run an unpinned package via npx daily-devotion-skill, which executes whatever version is current at install time. If the npm package is updated maliciously, compromised by account takeover, or replaced through a supply-chain incident, users could execute attacker-controlled code on their system.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 88% confidence

Finding

The helper command npx ts-node scripts/fetch_verse.ts relies on npx to resolve and execute ts-node without a pinned version, which introduces avoidable supply-chain risk. Even though ts-node is a common tool, an unpinned runtime dependency can still be swapped, typosquatted, or unexpectedly changed, leading to arbitrary code execution in the local environment.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill explicitly encourages tailoring prayers and devotions to the user's known context and later discusses sensitive categories like health, finances, relationships, and family, but it provides no privacy warning or handling guidance. This can normalize collection and reuse of sensitive personal or spiritual data without clear consent boundaries, increasing the risk of oversharing, retention, or unsafe downstream processing.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 152)May include surrounding context.

md

## Step 3: Handle Prayer Context

> [!IMPORTANT]
> **Do NOT ask the user for prayer requests interactively.** Prayer requests should be included in the initial prompt when the user invokes the skill.

**If prayer requests are provided in the prompt:**
- Incorporate them naturally into Part 4 of the prayer

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The file mandates a fixed religious formulation, including ending every prayer with "In Jesus' name I pray, Amen," and throughout assumes a single faith tradition. For a general-purpose skill, this imposes a specific belief/locale-style preference without stating that the skill is explicitly intended only for users who want Christian content.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.