Security audit
Security checks for vulnerabilities and agentic risk
The skill’s network, install, recovery, and optional feedback behavior is disclosed and bounded, with no evidence of hidden persistence, payment, wallet use, or destructive actions.
Install this only if you are comfortable with it downloading a pinned client from neomorphic.io, optionally installing locked npm dependencies, and using full caller result/checkpoint data that may contain sensitive tool output. Use a fresh work directory, review files before passing them in, and only provide endpoints or feedback tokens you intend the skill to contact.
Referenced artifact was not completely inspected
already released caller and point it at caller-owned files. The executable is `scripts/task-result.mjs`. The byte pins are `references/caller-pin.json`. This s
Referenced artifact was not completely inspected
already released caller and point it at caller-owned files. The executable is `scripts/task-result.mjs`. The byte pins are `references/caller-pin.json`. This s
Referenced artifact was not completely inspected
already released caller and point it at caller-owned files. The executable is `scripts/task-result.mjs`. The byte pins are `references/caller-pin.json`. This s
Referenced artifact was not completely inspected
already released caller and point it at caller-owned files. The executable is `scripts/task-result.mjs`. The byte pins are `references/caller-pin.json`. This s
Referenced artifact was not completely inspected
already released caller and point it at caller-owned files. The executable is `scripts/task-result.mjs`. The byte pins are `references/caller-pin.json`. This s
Referenced artifact was not completely inspected
already released caller and point it at caller-owned files. The executable is `scripts/task-result.mjs`. The byte pins are `references/caller-pin.json`. This s
The skill explicitly performs network-capable actions such as downloading an archive from neomorphic.io, installing dependencies from registry.npmjs.org, and optionally sending feedback over HTTPS, but it does not declare any tool scope or permissions boundary in the skill manifest. That mismatch weakens reviewability and enforcement, increasing the chance that a caller or platform will invoke networked behavior without clear consent or policy gating.
The skill's declared purpose is simple retention of a caller-provided result/checkpoint/statement, but the implementation also downloads a remote archive, extracts it, optionally runs npm ci, and later imports and uses that fetched code. Even with strong pinning and integrity checks, this materially expands the trust boundary and attack surface beyond the advertised function, creating supply-chain and network exposure that callers may not expect.
The skill is described as retaining an already-delivered result, but it can also initiate MCP and HTTP interactions, resume recovery flows, connect to endpoints, and submit feedback statements. This discrepancy is security-relevant because operators may invoke the skill expecting passive file handling while it actually performs outbound network actions and drives remote protocol behavior, increasing risk of unintended data disclosure or external side effects.
The environment passed to the child process explicitly sets LANG and LC_ALL to "C", which forces a specific language/locale during execution. This is a natural-language policy concern because the file provides no user opt-in or documented justification for overriding locale behavior.
Detected: suspicious.dangerous_exec