skill-base-web-deploy

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:20 AM UTC
• Version: 1.0.0

Overview

This deployment guide is not malicious, but its examples can expose a new administrator setup page on all network interfaces and run an unpinned npm package.

Review this before installing or sharing with operators. Use a reviewed, pinned skill-base version, initialize the first administrator while bound to 127.0.0.1 or behind trusted access controls, avoid publishing port 8000 broadly until setup is complete, and keep the data directory backed up and access-restricted.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:27

Finding

Unpinned npm Package Is Downloaded and Executed

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 27
Vulnerability Type: Unpinned third-party package execution
Risk Level: Medium

Vulnerable Code

bash

# Recommended: fix the data directory for easy backup and migration
npx skill-base -d ./skill-data -p 8000

Technical Analysis

The documented command invokes skill-base through npx without specifying an exact package version or verifying package integrity. If the package is not already available locally, npx can retrieve it from the configured npm registry and immediately execute it.

Because the selected package version can change after this skill has been reviewed, the command creates a mutable supply-chain execution path. The documentation does not specify a trusted registry, reviewed version, integrity digest, or package provenance verification procedure.

This finding does not establish that the current skill-base package is malicious. The vulnerability is the unsafe dependency execution pattern, which would allow a compromised or malicious future package release to execute code on the deployment host.

Attack Path

1. An attacker compromises the skill-base npm package, its publisher account, or the package distribution channel.
2. The attacker publishes a malicious version under the expected package name.
3. An administrator follows the documented Quick Start command without an exact version.
4. npx resolves and downloads the affected package version from the configured registry.
5. Package lifecycle or application code executes with the privileges of the administrator running the command.

Impact Assessment

Successful exploitation could permit arbitrary code execution under the deploying user's account. Depending on that account's permissions, the malicious package could access local files, environment variables, deployment credentials, service data, and network resources reachable from the host. If the comman ...[truncated 82 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the command to an exact, reviewed package version, for example:

  bash

  npx --yes skill-base@<reviewed-exact-version> -d ./skill-data -p 8000
  

• Document the expected npm registry and require verification of package provenance before deployment.

• Record and verify the package integrity digest in deployment automation.

• Prefer installing dependencies from a committed lockfile and using a reproducible installation process.

• Review package lifecycle scripts and disable them during installation where operationally compatible.

• Run the service from a dedicated, unprivileged operating-system account with access only to its required data directory.

• Test and approve dependency updates before changing the pinned version.

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:27

Finding

Public Default Binding Exposes the Uninitialized Administrator Wizard

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 27–52
Vulnerability Type: Insecure network exposure and first-user administrator takeover
Risk Level: High

Vulnerable Code

bash

# Recommended: fix the data directory for easy backup and migration
npx skill-base -d ./skill-data -p 8000

markdown

| `-h`, `--host` | Listening address, default `0.0.0.0` (listens on all local network cards/IPv4 addresses, accessible from both internal and external networks; set to `127.0.0.1` for local-only access) |

markdown

## First Access

When no administrator exists, opening the site in a browser will launch the **initialization wizard**: create a system administrator account and password. Afterward, team members need to be added by the administrator, and users log in via Web and CLI.

The Docker example at lines 70–71 similarly publishes the service on all host interfaces:

bash

docker run -d -p 8000:8000 -v "$(pwd)/data:/data" --name skill-base-server skill-base

Technical Analysis

The primary Quick Start command does not specify --host 127.0.0.1, while the documentation states that the application defaults to 0.0.0.0. The service therefore listens on every available IPv4 interface. The Docker example also uses -p 8000:8000, which ordinarily publishes the container port on all host interfaces.

At the same time, the documented first-access behavior allows the first visitor to create the system administrator when no administrator exists. This creates a race condition between the legitimate operator and any network-accessible attacker. Firewall advice in the troubleshooting section does not prevent this condition and may encourage opening the port before initialization is complete.

Attack Path

1. An operator starts a new instance using the documented Quick Start or Docker command.
2. The service binds or publishes port 8000 on all host interfaces.
3. The ins ...[truncated 1027 chars]

Remediation

View remediation

Remediation Suggestions

• Make loopback-only binding the default in every initial deployment example:

  bash

  npx skill-base --host 127.0.0.1 -d ./skill-data -p 8000
  

• Bind Docker port publication to loopback during initialization:

  bash

  docker run -d -p 127.0.0.1:8000:8000 \
    -v "$(pwd)/data:/data" \
    --name skill-base-server skill-base
  

• Require the operator to complete administrator initialization before allowing access from untrusted networks.

• Place production deployments behind a properly configured TLS reverse proxy or authenticated ingress.

• Restrict inbound traffic with host firewalls, cloud security groups, and network access-control lists to explicitly trusted sources.

• If remote initialization is unavoidable, use a temporary authenticated tunnel or VPN rather than directly exposing the wizard.

• Add a prominent warning that binding to 0.0.0.0 before initialization can allow first-user administrator takeover.

• Where supported by the application, protect initialization with a one-time bootstrap token generated locally or supplied through a protected secret.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (10)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The manifest/metadata references npx skill-base without a version pin, reinforcing the same unsafe execution pattern at discovery time. Because this is deployment guidance for the platform server itself, operators may trust and reuse the string as-is, increasing supply-chain exposure.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The skill metadata recommends invoking npx skill-base without a pinned package version, which causes execution of whatever version the registry resolves at runtime. This creates a supply-chain and reproducibility risk: a compromised, newly published, or breaking upstream release could be fetched and executed unexpectedly on the operator's machine or server.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

This description again instructs users to run npx skill-base without version pinning. Because npx may download and execute the latest package version, users are exposed to unexpected code execution if the package or dependency chain is altered upstream.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

The usage guidance tells operators to deploy the server using unpinned npx skill-base. In a deployment skill, this is more dangerous than casual local experimentation because it can place an unreviewed package version directly into a server setup path, affecting confidentiality, integrity, and availability.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

The startup options section normalizes npx skill-base as the canonical execution method without pinning. That means all later examples inherit the same supply-chain risk, and readers may copy the command into production or privileged environments.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The hardening example still uses npx skill-base without a version pin. Although the host binding is more secure, it does not mitigate the separate risk of fetching and executing an unexpected package version at startup.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The subpath deployment example references an unpinned npx skill-base invocation. In deployment documentation, repeated unpinned examples encourage unsafe operational practice and increase the likelihood of running an unintended upstream release.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The debug mode example invokes npx skill-base without version control. Even in debugging contexts, npx can fetch and execute the latest release, so troubleshooting steps may inadvertently run attacker-controlled or unreviewed code if the package supply chain is compromised.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 75% confidence

Finding

Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.