Pixelvault Setup

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 10:01 AM UTC
• Version: 1.0.0

Overview

This skill is a straightforward PixelVault CLI setup guide, with some normal setup risks around global npm installation and API key handling.

Before installing, confirm you intended to configure PixelVault specifically, verify the npm package and publisher, avoid running the install with elevated privileges, and prefer safer secret storage or a local untracked environment file over pasting API keys into shell history or a shared profile.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:19

Finding

Unpinned Global Installation of a Third-Party npm Package

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 19–23
Vulnerability Type: Unverified and unpinned third-party dependency installation
Risk Level: Medium

markdown

If not found, install it:

```bash
npm install -g pixelvault-cli

text

### Technical Analysis

The Skill instructs the agent to install `pixelvault-cli` globally from the npm registry without specifying a reviewed version, verifying package integrity, validating the publisher, or documenting an authoritative package source.

Because the package version is not pinned, the effective code installed can change after the Skill has been reviewed. npm packages may also execute lifecycle scripts during installation. A malicious package release, compromised maintainer account, package takeover, or registry-level supply-chain incident could therefore cause attacker-controlled code to execute with the privileges of the user running the installation.

The global installation scope increases exposure by making the executable available system-wide within the user's npm environment. The audited project does not provide evidence that the package identity, publisher, provenance, or release integrity is verified before installation.

### Attack Path

1. A user invokes the PixelVault setup Skill.
2. The Skill checks for the CLI using `which pixelvault`.
3. If the executable is absent, the agent runs `npm install -g pixelvault-cli`.
4. npm resolves the current package release from the configured registry because no version or integrity constraint is specified.
5. If the package, publisher account, dependency chain, or registry response has been compromised, malicious package code or lifecycle scripts execute during installation.
6. The resulting executable remains available in the user's global npm binary path and may execute additional attacker-controlled behavior when subsequent `pixelvault` commands are invoked.

### Impact Assessment

Successful e
...[truncated 684 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the CLI to a specifically reviewed version, for example pixelvault-cli@<approved-version>, and update it only through an explicit review process.
2. Verify the package name, publisher identity, repository, npm provenance attestations, and cryptographic integrity against PixelVault's authoritative documentation.
3. Document the canonical download source so agents do not rely solely on a package name supplied through registry resolution.
4. Prefer a project-local, isolated, or otherwise least-privileged installation instead of a global installation.
5. Review the package and its transitive dependencies, including lifecycle scripts, before approving a version.
6. Where compatible with the verified package installation process, disable npm lifecycle scripts using --ignore-scripts or install in a sandbox that restricts file, network, and credential access.
7. Do not run the installation with sudo, as an administrator, or from another elevated shell.
8. Use lockfiles and integrity metadata when distributing the CLI as part of a controlled project environment.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The description uses broad trigger phrases like 'set up image hosting' and 'get an API key for image uploads', which can cause the skill to be invoked in contexts that are only loosely related to PixelVault. Mis-triggering a setup skill can lead to unnecessary installation steps, credential prompts, or accidental reconfiguration of an existing environment.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill instructs users to pass API keys directly on the command line and to place secrets in shell profile files without warning about exposure risks. Command-line arguments may be captured in shell history or process listings, and profile files can persist secrets in plaintext, increasing the chance of credential leakage.

Content

No source excerpt is available for this finding.