risk-manager

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 6:53 AM UTC
• Version: 1.0.1

Overview

This is a coherent portfolio-risk helper that discloses its Finskills API dependency, with install and privacy cautions but no evidence of hidden or malicious behavior.

Before installing, prefer a pinned commit or versioned release instead of the mutable README command. Use a Finskills API key you are comfortable dedicating to this skill, and avoid entering portfolio details you do not want analyzed with queries to an external market-data provider.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: README.md:24

Finding

Unpinned npm CLI and Git Repository in Installation Command

Content

View full analysis

Vulnerability Details

File Location: README.md, line 24
Vulnerability Type: Supply-chain risk from mutable, unpinned dependencies
Risk Level: Medium

bash

npx skills add https://github.com/finskills/risk-manager --skill risk-manager

Technical Analysis

The documented installation command uses npx to retrieve and execute the skills npm package without specifying a reviewed version. It also installs the Skill from a GitHub repository URL without pinning it to a verified commit or immutable release artifact.

Both components are therefore mutable after this project has been audited. If the npm package, its maintainer account, the GitHub repository, or an associated publishing credential is compromised, the command may retrieve code different from the version originally reviewed. Since npx executes the downloaded CLI, malicious behavior could occur during installation rather than only when the installed Skill is later invoked.

Attack Path

1. An attacker compromises the npm package, a package maintainer account, the upstream GitHub repository, or relevant publishing credentials.
2. The attacker publishes a malicious version of the unpinned skills CLI or modifies the repository revision resolved by the installation command.
3. A user follows the installation instructions and runs the documented command.
4. npx downloads and executes the currently resolved CLI package, which may contain attacker-controlled code.
5. The CLI retrieves the current mutable repository content and installs it.
6. Malicious code can execute during installation or be placed in the installed Skill for later execution.

Impact Assessment

Successful exploitation could permit arbitrary code execution with the privileges of the user running the installation command. Depending on that user's permissions and environment, the attacker could access readable files and credentials, modify user-owned data, tamper with in ...[truncated 267 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the npm CLI to an explicitly reviewed version, for example by using an exact package version rather than allowing npx to resolve the latest release.
• Pin the GitHub source to a verified full commit hash or use an immutable, signed release artifact instead of the repository's mutable default branch.
• Enable integrity verification for downloaded packages and artifacts where supported.
• Publish release checksums and signatures through an independent trusted channel and document how users should verify them before installation.
• Use npm lockfiles and exact dependency versions for any packaged installer workflow.
• Run installation with least privilege and avoid executing it as root or another administrative account.
• Add automated dependency provenance, signature, and vulnerability checks to the release process.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The README instructs users to install the skill via npx skills add from a GitHub URL without pinning a specific immutable version, tag, or commit. This creates a supply-chain risk: if the upstream repository or dependency resolution changes, users may fetch and execute different code than originally reviewed, including potentially malicious updates.

Content

No source excerpt is available for this finding.

Ae4

Medium

• Category: analysis-evasion
• Confidence: 80% confidence

Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This skill instructs the agent to send portfolio holdings, positions, and possibly sensitive trading context to the external Finskills API, but it does not clearly disclose that user financial data will leave the local environment. That creates a privacy and data-governance risk because users may share account composition, risk tolerance, and trade plans without informed consent.

Content

No source excerpt is available for this finding.