Security audit

Data Validation

Security checks for vulnerabilities and agentic risk

Overview

This is a straightforward data-validation reference skill with a supply-chain caution around unpinned package examples.

Before installing or following the command examples, prefer pinned package versions, project lockfiles, or a disposable virtual environment/container, especially when validating sensitive project data. The skill itself is only documentation and does not include an executable payload.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:114
Finding: Unpinned Third-Party Packages Are Downloaded and Executed
Content: View full analysis
&1 || echo "INVALID: $f" done ``` ### Technical Analysis The documented commands resolve third-party packages from public registries without specifying reviewed versions, lockfiles, package hashes, or trusted registry configuration. In particular, `npx ajv-cli` may download and immediately execute the package and its transitive dependencies. Similarly, `pip install jsonschema` installs whichever compatible release the configured Python package index currently serves and may execute package build or installation logic. Because package resolution occurs when a user follows the instructions, the effective code can change after the Skill has been reviewed. A compromised maintainer account, malicious package release, registry compromise, dependency takeover, dependency confusion condition, or compromised transitive dependency could therefore introduce arbitrary code. The absence of version constraints also makes execution non-reproducible. ### Attack Path 1. A user follows the package usage instructions in `SKILL.md`. 2. `npx` or `pip` contacts the configured external package registry. 3. The package manager resolves an unpinned current release and its transitive dependencies. 4. An attacker-controlled or compromised package is downloaded. 5. Package installation hooks, build logic, or runtime code executes on the user's system. 6. The malicious code operates with the permission ...[truncated 987 chars]
Remediation: View remediation
validate -s schema.json -d data.json python3 -m pip install "jsonschema==" ``` 2. For Python, use an isolated virtual environment rather than modifying the active interpreter environment: ```bash python3 -m venv .venv . .venv/bin/activate python3 -m pip install --require-hashes -r requirements.txt ``` 3. Maintain a reviewed requirements file containing exact versions and cryptographic hashes. Use `--require-hashes` so altered artifacts are rejected. 4. For Node.js, declare `ajv-cli` in a project manifest, commit the generated lockfile, install with a lockfile-enforcing command such as `npm ci`, and invoke the locally installed binary. 5. Configure package managers to use approved registries and avoid falling back to untrusted public sources. 6. Review and update pinned dependencies through a controlled process that includes vulnerability scanning and integrity verification. 7. Run package installation and validation in a least-privileged container, sandbox, or disposable environment without sensitive credentials whenever feasible. ]]>

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: The skill recommends running npx ajv-cli without pinning an exact package version. This allows whatever version is current in the registry at execution time to be fetched and executed, creating a supply-chain risk if a malicious or compromised release is published or if behavior changes unexpectedly. In this skill context, the command is presented as normal validation guidance, which makes it more likely users will copy-paste it directly.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: This loop again invokes npx ajv-cli without an exact version pin, so execution depends on the latest registry state rather than a reviewed, deterministic dependency. An attacker who compromises the package or a future release could achieve arbitrary code execution on the user's machine when they follow the skill instructions. The repeated example increases exposure because it reinforces the unsafe usage pattern.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.