Security audit

Deploy

Security checks for vulnerabilities and agentic risk

Overview

This deployment skill is purpose-aligned, but it can automatically publish code, change production databases, and execute repository-controlled deployment instructions without clear approval gates.

Review this skill carefully before installing. It is not clearly malicious, but it should only be used in repositories and cloud environments where you are comfortable with an agent committing all changes, pushing to remotes, running migrations, and deploying to production. Require manual approval for exact commands, target branch, target environment, migration effects, and any repository-provided deployment scripts.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:68
Finding: Untrusted Project Plans Can Direct Arbitrary Deployment Command Execution
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: SKILL.md:52
Finding: Supabase CLI Is Executed Through Unpinned npx Package Resolution
Content: View full analysis
/dev/null && echo "SUPABASE_CLI=yes" || echo "SUPABASE_CLI=no" ``` ### Technical Analysis The CLI detection command invokes `npx supabase` without requiring a locally installed, lockfile-controlled package and without using an exact reviewed version. If the package is unavailable locally, `npx` may retrieve executable package content from the configured package registry. Consequently, a command intended only to detect a CLI can cause third-party code to be downloaded and executed. The effective code can change after the skill has been reviewed because no version or integrity value is specified. ### Attack Path 1. The Supabase CLI is not installed in the local project or package cache. 2. The skill runs `npx supabase --version` as a detection step. 3. `npx` resolves and downloads the package from the configured registry. 4. Package installation behavior or CLI entry-point code executes under the agent account. 5. A compromised registry package, compromised release, or unsafe registry configuration can execute malicious code and access resources available to the process. ### Impact Assessment The downloaded package executes with the privileges of the agent process. It may therefore access project files, readable environment variables, local tokens, and authenticated deployment configuration. The affected cloud scope depends on credentials available in the environment; no privilege beyond those existing permissions is inherently obtained. ]]>
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: SKILL.md:154
Finding: Drizzle Migration Commands Execute an Unpinned Package Through npx
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:123
Finding: Blanket Git Staging Can Commit and Push Sensitive Files
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (16)

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 367)May include surrounding context.
md
1. **Use installed CLIs** — detect `vercel`, `wrangler`, `supabase`, `fly`, `sst` before falling back to `npx`. 2. **Auto-deploy aware** — if platform auto-deploys on push, just push. Don't run manual deploy commands unnecessarily. 3. **NEVER commit secrets** — no .env files with real values, no API keys in code. 4. **Preview before production** — deploy preview first, verify, then promote to prod. 5. **Check build locally first** — `pnpm build` / `uv build` (or equivalent) before deploying. 6. **Check production logs** — always tail logs after deploy, catch runtime errors before declaring success.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The activation guidance includes broad phrases like 'deploy it' and 'push to production', which can match ordinary conversational requests and trigger a powerful deployment skill. Because this skill performs git pushes, database changes, repo creation, and production rollout, over-broad triggering raises the risk of accidental high-impact execution.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 83% confidence
Finding: The skill invokes npx supabase --version, which can fetch and execute a package version not explicitly pinned. In a deployment skill with Bash access, unpinned npx usage increases supply-chain risk because a compromised or unexpected upstream release could be executed on the operator's machine.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 85% confidence
Finding: The skill autonomously decides deployment behavior from YAML or fallback logic, including whether a push is sufficient or a platform-specific deploy is needed. In a deployment context, automated decision-making without an approval gate can send code live based on inferred configuration rather than explicit user intent.
Content: Scanner excerpt · SKILL.md (reported line 109)May include surrounding context.
md
If `$ARGUMENTS` specifies a platform, use that instead of auto-detection or YAML. **Auto-deploy platforms** (from YAML `deploy` field or fallback): - `vercel` / `cloudflare_pages` — auto-deploy on push. Push to GitHub is sufficient if project is already linked. Only run manual deploy for initial setup. - `cloudflare_workers` — `wrangler deploy` needed (no git-based auto-deploy for Workers). - `fly.io` — `fly deploy` needed.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 85% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · SKILL.md (reported line 110)May include surrounding context.
md
If `$ARGUMENTS` specifies a platform, use that instead of auto-detection or YAML. **Auto-deploy platforms** (from YAML `deploy` field or fallback): - `vercel` / `cloudflare_pages` — auto-deploy on push. Push to GitHub is sufficient if project is already linked. Only run manual deploy for initial setup. - `cloudflare_workers` — `wrangler deploy` needed (no git-based auto-deploy for Workers). - `fly.io` — `fly deploy` needed.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 85% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · SKILL.md (reported line 111)May include surrounding context.
md
If `$ARGUMENTS` specifies a platform, use that instead of auto-detection or YAML. **Auto-deploy platforms** (from YAML `deploy` field or fallback): - `vercel` / `cloudflare_pages` — auto-deploy on push. Push to GitHub is sufficient if project is already linked. Only run manual deploy for initial setup. - `cloudflare_workers` — `wrangler deploy` needed (no git-based auto-deploy for Workers). - `fly.io` — `fly deploy` needed.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 85% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · SKILL.md (reported line 198)May include surrounding context.
md
If `$ARGUMENTS` specifies a platform, use that instead of auto-detection or YAML. **Auto-deploy platforms** (from YAML `deploy` field or fallback): - `vercel` / `cloudflare_pages` — auto-deploy on push. Push to GitHub is sufficient if project is already linked. Only run manual deploy for initial setup. - `cloudflare_workers` — `wrangler deploy` needed (no git-based auto-deploy for Workers). - `fly.io` — `fly deploy` needed.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 85% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · SKILL.md (reported line 366)May include surrounding context.
md
If `$ARGUMENTS` specifies a platform, use that instead of auto-detection or YAML. **Auto-deploy platforms** (from YAML `deploy` field or fallback): - `vercel` / `cloudflare_pages` — auto-deploy on push. Push to GitHub is sufficient if project is already linked. Only run manual deploy for initial setup. - `cloudflare_workers` — `wrangler deploy` needed (no git-based auto-deploy for Workers). - `fly.io` — `fly deploy` needed.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill instructs automatic git add, git commit, git push, and even gh repo create --push without an explicit approval checkpoint. In context, that can publish unreviewed code, exfiltrate proprietary work to a new remote, or alter repository history based on an ambiguous deployment request.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 88% confidence
Finding: The instruction that pushing to main is sufficient for auto-deploy platforms directly links a git push to production release. In context, because the skill also performs automated pushes, this creates a clear path to unintended live deployment without a separate confirmation step.
Content: Scanner excerpt · SKILL.md (reported line 140)May include surrounding context.
gh repo create {project-name} --private --source=. --push

text
**For platforms with auto-deploy (Vercel, CF Pages):** pushing to main triggers deployment automatically. Skip manual deploy commands if project is already linked. ### Step 2. Database Setup

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The database section directs schema push and migration commands (supabase db push, drizzle-kit push, wrangler d1 migrations apply) without requiring a warning or confirmation. These operations can irreversibly alter production databases, cause data loss, or apply incompatible schema changes if auto-executed.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 90% confidence
Finding: npx drizzle-kit push executes an unpinned package during a database deployment step. Because this runs in a privileged operational context and can alter schema state, an unexpected or malicious package release could both execute arbitrary code and change production data structures.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 90% confidence
Finding: npx drizzle-kit generate has the same unpinned execution risk as other npx calls. In a deploy workflow, this can introduce supply-chain exposure at the exact moment code and schema artifacts are being prepared for production.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The skill says not to write real secrets to local .env files, but then recommends shell patterns such as vercel env add NAME production <<< "value" and fly secrets set VARIABLE_NAME=value. Supplying secrets directly on the command line or via shell redirection can expose them to shell history, process inspection, logs, transcripts, or agent output capture.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill includes direct production deployment commands such as vercel --prod, wrangler deploy, fly deploy, and sst deploy --stage prod without an explicit publish approval gate. This is dangerous because a simple invocation can immediately change live infrastructure or user-facing services.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 85% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · SKILL.md (reported line 366)May include surrounding context.
md
## Critical Rules 1. **Use installed CLIs** — detect `vercel`, `wrangler`, `supabase`, `fly`, `sst` before falling back to `npx`. 2. **Auto-deploy aware** — if platform auto-deploys on push, just push. Don't run manual deploy commands unnecessarily. 3. **NEVER commit secrets** — no .env files with real values, no API keys in code. 4. **Preview before production** — deploy preview first, verify, then promote to prod. 5. **Check build locally first** — `pnpm build` / `uv build` (or equivalent) before deploying.