Noodle Create Writing

• Outcome: Review
• Latest audit: May 28, 2026 · 1:04 PM UTC
• Version: 1.0.0

Overview

This writing skill is mostly coherent, but it can pass user-provided article topics into a shell command during search, which makes it risky to run with untrusted input.

Review before installing. Do not run this skill with untrusted topics or keywords until the search command is rewritten to use safe argument passing or a direct API call. If you proceed, use a constrained workspace, set the Tavily API key intentionally, avoid confidential prompts, inspect generated posts before publishing, and delete raw output data you do not want retained.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill clearly states it uses the Tavily API to search based on user-supplied topics and keywords, but it does not warn users that their prompts will be transmitted to a third-party service. This creates a privacy and data-handling risk because users may provide sensitive business ideas, unpublished content plans, or personal information under the assumption the processing is local.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The script writes raw search results and extracted data to a JSON file on disk by default, which can persist potentially sensitive or copyrighted source material, query terms, and derived data without an explicit warning or opt-in. In an agent/skill context, automatic persistence increases the chance of unintended disclosure through shared workspaces, backups, logs, or later processing by other tools.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The command is built as a single shell string and includes untrusted query text derived from user-controlled topic/keywords. Because execSync invokes a shell, crafted input containing shell metacharacters or quotes can break out of the intended argument context and execute arbitrary commands on the host.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"author": "飞云儿",
  "license": "MIT",
  "dependencies": {
    "axios": "^1.6.0",
    "cheerio": "^1.0.0",
    "marked": "^12.0.0",
    "yargs": "^17.7.0"

• Confidence: 84% confidence
• Finding: Using a caret range for axios allows future installs to resolve to different versions than originally tested, which weakens supply-chain reproducibility and can silently introduce vulnerable or breaking releases. Because this skill appears to perform automated web fetching and content aggregation, dependency drift in a network-facing library meaningfully raises risk.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"license": "MIT",
  "dependencies": {
    "axios": "^1.6.0",
    "cheerio": "^1.0.0",
    "marked": "^12.0.0",
    "yargs": "^17.7.0"
  },

• Confidence: 80% confidence
• Finding: A caret range for cheerio makes builds non-reproducible and increases supply-chain uncertainty, though this is a lower-risk parser dependency than a direct network client. The main concern is accidental uptake of compromised or vulnerable transitive code during future installs.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"dependencies": {
    "axios": "^1.6.0",
    "cheerio": "^1.0.0",
    "marked": "^12.0.0",
    "yargs": "^17.7.0"
  },
  "devDependencies": {

• Confidence: 80% confidence
• Finding: An unpinned marked dependency permits version drift and may introduce parser vulnerabilities or unsafe rendering behavior in later installs. In a content-generation skill that may process external text or markdown, parser changes can have security implications if output is later rendered in other contexts.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"axios": "^1.6.0",
    "cheerio": "^1.0.0",
    "marked": "^12.0.0",
    "yargs": "^17.7.0"
  },
  "devDependencies": {
    "@types/node": "^20.0.0"

• Confidence: 76% confidence
• Finding: Using a caret range for yargs introduces the same supply-chain reproducibility risk, although the direct security impact is typically limited to argument parsing behavior. It is still a true security hygiene issue because broad ranges can unexpectedly pull in vulnerable releases.

Known Vulnerable Dependency: axios==1.6.0 — 10 advisory(ies): CVE-2025-62718 (Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF); CVE-2026-42044 (Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget in `pars); CVE-2026-25639 (Axios is Vulnerable to Denial of Service via __proto__ Key in mergeConfig) +7 more

High

• Category: Supply Chain
• Confidence: 97% confidence
• Finding: The manifest includes axios 1.6.0, which is explicitly flagged as having multiple known vulnerabilities, including SSRF-related proxy bypass and prototype-pollution/DoS issues. This skill's stated behavior involves automatic searching and remote content retrieval, so a vulnerable HTTP client is especially dangerous because attacker-controlled URLs, responses, or proxy settings could be leveraged during network operations.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/search-content.js:162