NoUI

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:58 AM UTC
• Version: 1.0.0

Overview

This is a NoUI discovery skill with no bundled code execution, but its install instructions fetch mutable remote components that can handle authenticated browser sessions and agent skill changes.

Review the upstream NoUI repository and installer before running the commands. Prefer a pinned `skills` package version and a pinned NoUI commit or signed release, and run setup in a least-privilege or disposable environment, especially before granting access to authenticated browser sessions, cookies, MCP servers, or agent skill directories.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:27

Finding

Unpinned Third-Party Package and Remote Skill Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 27-56
Vulnerability Type: Unpinned and mutable third-party dependencies
Risk Level: Medium

The skill directs users and AI agents to install components using an unversioned npx package and a GitHub repository that is not pinned to a reviewed commit, tag, or signed release.

Vulnerable code:

bash

npx skills add https://github.com/adoptai/noui --skill noui-setup
npx skills add https://github.com/adoptai/noui --skill noui-record-login
npx skills add https://github.com/adoptai/noui --skill noui-record-workflow
npx skills add https://github.com/adoptai/noui --skill noui-generalize
npx skills add https://github.com/adoptai/noui --skill noui-autopilot
npx skills add https://github.com/adoptai/noui --skill noui-generate-mcp
npx skills add https://github.com/adoptai/noui --skill noui-generate-skill

bash

npx skills add https://github.com/adoptai/noui --skill airbnb-search-places
npx skills add https://github.com/adoptai/noui --skill expedia-stay-search

bash

npx skills add https://github.com/adoptai/noui

Technical Analysis

The command npx skills does not specify an exact package version or integrity hash. Depending on the local npm environment and cache state, npx may retrieve and execute the currently published version of the package. The repository URL is also mutable because it is not tied to a specific reviewed commit or immutable artifact.

This creates a time-of-review versus time-of-installation gap: the package and downstream skill content executed by a user can differ from the content that existed when this discovery skill was audited. A compromised package publisher, npm account, GitHub account, repository, or upstream release process could replace the expected content with hostile instructions or executable code.

The downstream implementations are not included in this project and therefore could not be i ...[truncated 2036 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the npm CLI package to an exact, reviewed version instead of invoking an unversioned package, for example by using an explicitly approved version.
2. Pin the NoUI repository dependency to a reviewed commit SHA or immutable signed release rather than the repository's mutable default branch.
3. Verify package integrity using lockfiles, checksums, provenance attestations, or cryptographic signatures before installation.
4. Vendor or include the downstream skill files in the audited project so their commands, scripts, dependencies, and permission requirements can be reviewed.
5. Require explicit user confirmation before downloading, installing, or invoking any remote skill, particularly skills that configure environments or interact with authenticated browser sessions.
6. Execute installation and setup in a least-privilege sandbox or disposable environment with restricted filesystem, network, credential, and browser-session access.
7. Document the exact expected package version, repository revision, file hashes, permissions, and network destinations so unexpected upstream changes can be detected.
8. Re-audit and reapprove dependency updates before changing any pinned package version or repository revision.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (10)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

This command tells users to fetch and execute the latest published skills package via npx without pinning a specific version or integrity hash. If the upstream package, dependency chain, or resolution source is compromised, users may execute unexpected code during installation.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

This instruction invokes npx skills without a pinned version, so it will resolve whatever version is current at runtime. That creates a supply-chain risk: a malicious or compromised release could run arbitrary install-time code on the user's system.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

Because npx executes a package resolved at runtime, using npx skills without version pinning makes the behavior non-reproducible and vulnerable to upstream compromise. In a skill whose purpose is to install additional components, this directly exposes users to supply-chain execution risk.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The command uses an unpinned npx skills invocation, which can pull and execute whatever version is current when the user runs it. If the package or registry path is tampered with, this could lead to arbitrary code execution during setup.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

Running npx skills without pinning means the installation path depends on mutable upstream state. That is a classic software supply-chain weakness, especially risky in documentation that encourages repeated execution across environments.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

This is another unpinned runtime package execution through npx, allowing the resolved code to change over time without review by the user. A compromised release could abuse install-time privileges or alter installed skills.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The skill instructs users to run npx skills without constraining the package version, exposing them to upstream package or dependency compromise. Since the command installs more automation components, the trust boundary is broad and the blast radius can extend beyond a single package.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

This demo install command still executes an unpinned skills package via npx, so it carries the same supply-chain risk as the core workflow commands. Optional/demo status does not reduce the risk if users are encouraged to run it on their machines.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

This command references npx skills without version pinning, allowing package contents to drift over time and making compromise of the package distribution path dangerous. Because the skill is related to authenticated browser automation, any malicious install payload could target sensitive local tokens or sessions.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The all-in-one install command also relies on unpinned npx skills, so users execute whatever package version is current at the time. In this skill context, that is somewhat more dangerous because the command is the broadest install path and may be the one most likely copied by end users.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.