Init

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:21 PM UTC
• Version: 2.1.1

Overview

The skill is mostly clear onboarding setup, but its optional Solograph check can execute an unpinned third-party package, which warrants Review.

Review this skill before installing. Its normal setup files are understandable and editable, but avoid letting it run `uvx solograph` or install Solograph unless you explicitly trust the package source and version. Expect it to create persistent org defaults in your home directory and project-specific `.solo/` files that other Solo Factory skills will read.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:119

Finding

Unpinned Third-Party Package Retrieval and Execution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 119–122
Vulnerability Type: Unpinned package retrieval and execution
Risk Level: Medium

Vulnerable Code

markdown

### 10. Verify Solograph MCP (optional check)

- Try running `uvx solograph --help` or check if MCP tools are available
- If available: "Solograph detected — code graph ready"
- If not: "Tip: install Solograph for code search across projects (`pip install solograph` or `uvx solograph`)"

Technical Analysis

The command uvx solograph --help may retrieve the latest available solograph package from an external package index and immediately execute its entry point. The dependency is not pinned to a reviewed version or verified with a cryptographic hash. The suggested pip install solograph command is also unpinned.

Executing a package merely to detect its availability crosses a trust boundary: the code that runs can change after this Skill has been reviewed. If the package, maintainer account, package index, or dependency chain is compromised, arbitrary code could execute under the Agent user's account.

Attack Path

1. An attacker compromises the solograph package, one of its dependencies, its publisher account, or the relevant package-distribution channel.
2. The attacker publishes a malicious release that preserves the expected package name and command interface.
3. The Skill performs its optional check by running uvx solograph --help.
4. uvx resolves and downloads the unpinned release.
5. The malicious package code executes during installation, import, or entry-point startup.
6. The payload operates with the permissions and environmental access of the user running the Agent.

Impact Assessment

Successful exploitation could provide arbitrary code execution with the Agent user's privileges. Depending on the runtime environment, this may expose source code, project configuration, accessible credentials and environment variables, writable user file ...[truncated 152 chars]

Remediation

View remediation

Remediation Suggestions

1. Do not use package execution as an availability check. Prefer a non-executing local lookup, such as checking whether an already-installed executable exists.
2. Require explicit user approval before downloading or installing any external package.
3. Pin solograph to a specifically reviewed version rather than resolving the latest release.
4. Verify downloaded artifacts with trusted hashes or signatures and use a locked dependency manifest.
5. Retrieve packages only from an explicitly configured, trusted index.
6. Where feasible, execute third-party tooling in a sandbox with restricted filesystem, credential, environment-variable, and network access.
7. Clearly distinguish between checking for an existing local installation and offering installation instructions.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger phrases include broad terms like "configure defaults," "first time setup," and "onboard me," which may match ordinary conversation and cause unintended invocation of a state-changing skill. Because this skill writes files to both the project and the user's home directory, accidental activation has meaningful side effects.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

The skill persists user-provided data under ~/.solo-factory/defaults.yaml, creating cross-project session state in the home directory. Persistent storage is not inherently malicious, but it becomes a security concern because it can retain sensitive organizational identifiers and influence behavior of other skills without strong validation or explicit consent boundaries.

Content

Scanner excerpt · SKILL.md (reported line 64)May include surrounding context.

See references/questions.md → "Round 0: Org Defaults" for full question specs.

4. Create org defaults

bash

mkdir -p ~/.solo-factory

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 83% confidence

Finding

The skill instructs use of uvx solograph --help without pinning a specific version, which can cause different code to be fetched and executed over time. In a skill context, this creates supply-chain and reproducibility risk because a compromised or breaking upstream release could be invoked during onboarding.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 80% confidence

Finding

The installation tip again references uvx solograph without version pinning, encouraging users to run an unpinned remote package. This increases exposure to supply-chain compromise and makes behavior non-deterministic across runs and environments.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/generation-rules.md (reported line 55)May include surrounding context.

md

- **Data philosophy** answer → "Data & Privacy" section
- **Pricing** answer → "Pricing Philosophy" section

Keep the structure of the template but rewrite sections to reflect the founder's specific choices. Keep the "Principles" section (AI is foundation, Offline-first, One pain → one feature, Speed over perfection, Antifragile architecture) but adjust emphasis based on answers:
- If they chose "Privacy & data ownership" → emphasize "Privacy isn't a feature, it's architecture"
- If they chose "Speed to market" → emphasize "Ship > Perfect"
- If they chose "Cloud-first" → soften offline-first language, emphasize encryption instead

Static analysis

No suspicious patterns detected.