vibe-coding-skills-installer

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:05 AM UTC
• Version: 1.0.2

Overview

The skill is an installer for the advertised tools, but it can modify agent skill directories and run unpinned third-party code from the network.

Review before installing. Only run this skill if you trust the upstream npm package and GitHub repositories, and prefer project scope over global scope where possible. Ask the agent to show the exact commands, target directories, repository commits, and rollback steps before proceeding.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T08 · Insecure Dependencies

Error

• Location: scripts/install.sh:162

Finding

Mutable npm Package Installed Globally Without Integrity Pinning

Content

View full analysis

Vulnerability Details

File Location: scripts/install.sh:162-167
Vulnerability Type: Unpinned third-party package installation
Risk Level: High

Vulnerable Code

bash

global)
  echo "STEP: Installing OpenSpec CLI globally..."
  npm install -g @fission-ai/openspec@latest
  echo "STATUS: ok | ACTION: openspec-cli-installed"
  ;;

Technical Analysis

The installer requests the mutable latest release of @fission-ai/openspec rather than an audited, immutable version. npm installation can execute package lifecycle scripts, meaning the effective code executed by this Skill may change after the Skill itself has been reviewed.

The package is also installed globally. Depending on the npm configuration and the account running the Skill, this writes to a user-wide or system-wide package location and exposes the installed executable outside the current project. No checksum, package signature, lockfile, or expected version is validated before installation.

This network access is relevant to the declared installer functionality, but using a mutable release and global scope exceeds a safer minimum-trust implementation.

Attack Path

1. An attacker compromises the upstream npm package, publisher credentials, or a future release selected by the latest tag.
2. A user selects the OpenSpec global installation option.
3. The script downloads the attacker-controlled package through npm.
4. Malicious npm lifecycle code executes during installation under the privileges of the user running the script.
5. The globally installed executable can remain available to later projects and sessions.

Impact Assessment

Successful exploitation could execute arbitrary commands with the invoking user's privileges, read or modify files accessible to that user, access credentials available to child processes, and alter user-wide development tooling. If the installer is manually run with elevated privileges, the ...[truncated 104 chars]

Remediation

View remediation

Remediation Suggestions

• Replace @latest with an exact, reviewed package version.
• Verify package integrity against a trusted, documented digest before installation.
• Prefer a project-local installation with a lockfile over global installation where functionality permits.
• Display the exact package version and requested installation scope, then require explicit user confirmation.
• Consider installing with lifecycle scripts disabled during verification, then allow scripts only after reviewing the package contents.
• Document the files and executable paths that the package is expected to create.

T03 · Remote Payload Retrieval and Execution

Error

• Location: scripts/install.sh:213

Finding

Downloaded gstack Repository Is Immediately Executed Without Revision Verification

Content

View full analysis

Vulnerability Details

File Location: scripts/install.sh:213-224
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Vulnerable Code

bash

global)
  local gstack_dir="$GLOBAL_SKILLS/gstack"
  echo "STEP: Cloning gstack to $gstack_dir ..."
  mkdir -p "$GLOBAL_SKILLS"
  if [[ -d "$gstack_dir" ]]; then
    echo "STEP: gstack directory already exists, pulling latest..."
    (cd "$gstack_dir" && git pull --ff-only 2>/dev/null || true)
  else
    git clone --single-branch --depth 1 "$GSTACK_REPO" "$gstack_dir"
  fi
  echo "STEP: Running gstack setup --host $host_flag ..."
  (cd "$gstack_dir" && ./setup --host "$host_flag")
  echo "STATUS: ok | ACTION: gstack-global-installed | HOST: $host_flag | PATH: $gstack_dir"
  ;;

The same behavior is present for project installation at scripts/install.sh:227-238.

Technical Analysis

The script clones the current default branch of the external gstack repository or updates an existing checkout with git pull. It then immediately executes the repository's setup program. Neither the initial clone nor the update is pinned to an immutable commit or validated using a signature or trusted digest.

Consequently, the code executed by the installer is controlled by the current upstream repository state rather than by the reviewed Skill package. Suppressing update errors with 2>/dev/null || true also obscures failures and may result in execution of a stale, partially understood, or locally modified checkout.

Installing gstack necessarily requires obtaining its content, but automatically executing mutable upstream code without verification is not the minimum privilege or minimum trust necessary for that purpose.

Attack Path

1. An attacker compromises the gstack repository, its maintainer credentials, or the branch used as the repository default.
2. The attacker modifies the remote setup program or ...[truncated 864 chars]

Remediation

View remediation

Remediation Suggestions

• Pin gstack to a reviewed commit hash or cryptographically signed release tag.
• Verify the fetched commit and expected file digests before running setup.
• Do not automatically run git pull on an existing installation; present the proposed revision and request explicit update approval.
• Reject dirty or unexpected existing repositories instead of silently using them.
• Remove 2>/dev/null || true and report update failures clearly.
• Inspect and display the setup actions before execution.
• Where practical, execute setup in a constrained environment with only the filesystem and environment access required for installation.

T03 · Remote Payload Retrieval and Execution

Warning

• Location: scripts/install.sh:173

Finding

Mutable Remote Skill Content Is Installed Into Trusted Agent Directories

Content

View full analysis

Vulnerability Details

File Location: scripts/install.sh:173-193
Vulnerability Type: Unverified remote Skill installation
Risk Level: Medium

Vulnerable Code

bash

workflows)
  echo "STEP: Installing OpenSpec workflow skills to $PROJECT_SKILLS/ ..."
  local tmpdir
  tmpdir=$(mktemp -d)
  git clone --depth 1 "$OPENSPEC_WORKFLOWS_REPO" "$tmpdir/openspec-workflows"
  mkdir -p "$PROJECT_SKILLS"
  # Copy all openspec-* skill directories found in the cloned repo
  local found=0
  for src_dir in "$tmpdir/openspec-workflows/.cursor/skills/openspec-"* \
                 "$tmpdir/openspec-workflows/.claude/skills/openspec-"* \
                 "$tmpdir/openspec-workflows/.agents/skills/openspec-"* \
                 "$tmpdir/openspec-workflows/skills/openspec-"*; do
    if [[ -d "$src_dir" ]]; then
      local basename
      basename=$(basename "$src_dir")
      cp -r "$src_dir" "$PROJECT_SKILLS/$basename"
      found=$((found + 1))
    fi
  done
  rm -rf "$tmpdir"

Related mutable repository installation and update behavior for Superpowers occurs at scripts/install.sh:260-309.

Technical Analysis

The installer retrieves the current default branch of remote repositories and copies or clones their content into project-level or global Agent skill directories. No commit pin, signature verification, checksum validation, or content review is performed.

Although these files are not directly executed by this particular shell branch, Agent skill directories are trusted locations whose instructions or scripts may be loaded and acted upon in later sessions. Mutable upstream content can therefore change the effective behavior of the installed Skill after this installer has been audited.

The use of network retrieval is expected for an installer. The unsafe element is treating an unverified, mutable remote branch as trusted Agent configuration.

Attack Path

1. An attacker comprom ...[truncated 972 chars]

Remediation

View remediation

Remediation Suggestions

• Pin every repository to a reviewed commit hash or signed release tag.
• Publish and verify cryptographic hashes for all copied Skill files.
• Present the source repository, exact commit, destination, and file list before installation.
• Require explicit confirmation before writing to global Agent skill directories.
• Scan copied Skill instructions and scripts for unsafe commands or instruction-hijacking behavior.
• Avoid automatic updates; implement a reviewable update process that shows changes between the installed and proposed revisions.
• Verify that copied paths contain only expected file types and reject symbolic links or other unexpected filesystem objects.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence

Finding

The code is clearly related to the declared domain: installing/configuring openspec, gstack, and superpowers across agent platforms. So the overall purpose is aligned. However, the description overstates and inaccurately characterizes important behavior. Most notably, it says the skill 'interactively asks' about target platform/scope/options, but this script is strictly flag-driven with no prompts. It also suggests a general installer for supported platforms, while the code has a fixed set of known hosts and falls back to codex-style paths when detection fails. Additionally, the script does more than just install skill sets: it checks dependencies, installs the OpenSpec CLI globally via npm, verifies installations, and may only emit manual instructions rather than performing installation for some superpowers cases. These are material description-behavior mismatches, though the core theme remains related.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill directs execution of commands that can modify global user environments, project repositories, and install external software/plugins, but it does not provide a clear up-front warning or explicit confirmation around those side effects. In an agent setting, that increases the risk of unintended system changes, supply-chain exposure, or repo modifications being performed with insufficient user awareness.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.