react-jsmind-usage

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 7:57 AM UTC
• Version: 1.0.0

Overview

This skill is a straightforward React package usage guide with ordinary dependency-installation caution and no hidden or destructive behavior.

Install this as a benign integration helper. Before using the npm/yarn command in important projects or CI, pin a known version, keep a lockfile, and review the package and its transitive dependencies like you would for any third-party React dependency.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:20

Finding

Unpinned Third-Party Package Installation Creates Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 20-22
Vulnerability Type: Unpinned and unverified third-party dependency installation
Risk Level: Medium

Vulnerable Code

bash

npm install @frank17008/react-jsmind
# or
yarn add @frank17008/react-jsmind

Technical Analysis

The Skill instructs users to install @frank17008/react-jsmind without specifying a reviewed version or requiring lockfile and integrity verification. Consequently, the package manager resolves the dependency to the version selected by the registry and package manager at installation time rather than to the exact release that was audited.

This does not establish that the referenced package is currently malicious. However, it creates a supply-chain exposure because a future release can differ from the package contents available when the Skill was reviewed. If the package publisher, publishing credentials, registry namespace, or a transitive dependency is compromised, users following these instructions could install attacker-controlled content.

Depending on package-manager configuration, dependency installation can execute package lifecycle scripts. Such scripts run locally under the identity and permissions of the user invoking npm or yarn.

Attack Path

1. An attacker compromises the package publisher, publishing token, package namespace, or a relevant transitive dependency.
2. The attacker publishes a malicious package version or modifies the dependency graph of a new release.
3. A developer follows the Skill and runs the unpinned installation command.
4. The package manager resolves and downloads the attacker-controlled release.
5. Malicious lifecycle scripts may execute during installation, or malicious runtime code may execute when the application imports and uses the package.
6. The payload operates with the privileges of the developer or build-system account running the package manager.

Impact A

...[truncated 643 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin installation instructions to an exact version that has undergone review, for example:

   bash

   npm install --save-exact @frank17008/react-jsmind@REVIEWED_VERSION
   

2. Commit a package lockfile and use npm ci in CI and other reproducible build environments.
3. Verify package provenance, maintainers, release history, registry source, and integrity metadata before approving a version.
4. Review direct and transitive dependency lifecycle scripts before installation.
5. Where operationally appropriate, perform the initial dependency inspection with lifecycle scripts disabled:

   bash

   npm install --ignore-scripts --save-exact @frank17008/react-jsmind@REVIEWED_VERSION
   

6. Run dependency installation in an isolated, least-privileged build environment without unnecessary production credentials.
7. Use automated dependency scanning and controlled update review rather than allowing newly published versions to be adopted implicitly.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The sample data uses Chinese strings for the mind-map name and topics, but the skill does not state that Chinese is optional example content or that the tool is intended for a Chinese-only context. This can be read as prescribing a specific language/locale in violation of the policy against forcing a language without user opt-in.

Content

No source excerpt is available for this finding.