Pdauth

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:21 AM UTC
• Version: 1.0.0

Overview

The skill is openly about connecting accounts for agent use, but it grants very broad third-party account power with limited safety guardrails and installs an unpinned executable dependency.

Review this carefully before installing. Only authorize apps you actually need, confirm the exact account and action before allowing writes or sends, and prefer a pinned, reviewed version of the `pdauth` package before using it with important accounts.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:10

Finding

Unpinned Executable npm Dependency

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 10-18
Vulnerability Type: Supply-chain exposure through an unpinned executable dependency
Risk Level: Medium

Vulnerable Code

json

"install":
  [
    {
      "id": "node",
      "kind": "node",
      "package": "pdauth",
      "bins": ["pdauth"],
      "label": "Install pdauth (node)",
    },
  ]

Technical Analysis

The installation configuration specifies the executable npm package pdauth without an exact version, lockfile, integrity hash, or other provenance control. Consequently, installation may resolve to whichever package version is current in the configured registry rather than to a version that was reviewed with this Skill.

The remainder of the Skill delegates sensitive operations to this binary, including Pipedream credential configuration, OAuth authorization-link generation, connected-account enumeration, and third-party API calls. This creates a supply-chain trust boundary: a compromised registry account, malicious package release, dependency-confusion condition in a misconfigured registry, or unexpectedly unsafe upstream update could cause attacker-controlled code to execute under the agent's privileges.

The audit found no evidence that the currently referenced package is malicious. The confirmed issue is the absence of dependency pinning and integrity verification for a security-sensitive executable.

Attack Path

1. An attacker compromises the upstream npm package or its publisher account, or causes the environment to resolve pdauth from an unsafe registry source.
2. The attacker publishes a malicious version under the package name accepted by this installation configuration.
3. A user or agent installs the Skill dependency without a version constraint or integrity check.
4. The package manager resolves and installs the attacker-controlled release.
5. The malicious executable runs during configuration ...[truncated 974 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin pdauth to a reviewed exact version rather than allowing mutable latest-version resolution.
2. Commit and enforce an appropriate package lockfile with integrity metadata.
3. Verify package publisher ownership, registry provenance, release signatures where available, and expected integrity hashes before installation.
4. Configure the package manager to use an explicitly trusted registry and disable unintended fallback to private or untrusted registries.
5. Review the pinned package and its transitive dependencies for install scripts, network behavior, credential storage, and update mechanisms.
6. Run the executable in a least-privileged environment with restricted filesystem, environment-variable, process, and network access.
7. Grant only the minimum OAuth scopes necessary for each operation and isolate credentials by user and service.
8. Document expected Pipedream endpoints and authorization domains so unexpected OAuth links or network destinations can be rejected.
9. Establish a controlled update process that repeats code review and integrity verification before changing the pinned version.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill instructs an agent to obtain OAuth authorization for 2500+ third-party APIs and then execute tools on the user's behalf, but it does not warn about the scope of access, potential data exposure, or account-impacting actions that may follow. In an agent context, this is dangerous because users may click an authorization link without understanding that the agent can subsequently read, modify, or send data through connected services.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The example workflow culminates in an externally visible action on the user's Spotify account, but it provides no warning that actions taken through authorized tools can change account state or affect third-party services. This normalizes execution of side-effecting operations immediately after authorization, increasing the chance that agents will perform modifications without explicit confirmation at the point of action.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.