Makefile & Build

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 9:18 AM UTC
• Version: 1.0.0

Overview

This skill is a straightforward Makefile guide with explicit examples, though users should review copied targets before running install, clean, deploy, or Docker commands.

Before using this skill's generated templates, review clean targets, install targets, Docker push targets, deploy scripts, and Node npx commands. Prefer pinned dependencies and lockfiles, and only run sudo, deploy, or push targets when you intentionally want those effects.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:222

Finding

Unpinned npx Commands May Download and Execute Unreviewed Packages

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 222-239
Vulnerability Type: Insecure third-party package execution
Risk Level: Medium

Vulnerable Code:

makefile

build: node_modules ## Build TypeScript
	npx tsc

test: node_modules ## Run tests
	npx vitest run

test-watch: node_modules ## Run tests in watch mode
	npx vitest

lint: node_modules ## Lint code
	npx eslint src/ --ext .ts,.tsx
	npx tsc --noEmit

fmt: node_modules ## Format code
	npx prettier --write 'src/**/*.{ts,tsx}'

dev: node_modules ## Run in development mode
	npx tsx watch src/index.ts

Technical Analysis

The documented Makefile recipes invoke several tools through npx without --no-install, explicit package versions, or a prerequisite that verifies each executable is installed locally. When a requested executable cannot be found in the project's local dependencies, npx may resolve and download a package from the configured npm registry before executing it.

This behavior creates a supply-chain execution path in which the effective code may not be limited to dependencies already reviewed and pinned by the project's lockfile. Registry compromise, malicious registry configuration, package compromise, dependency confusion, or an incorrectly resolved package could cause unintended third-party code to execute during routine build, test, lint, formatting, or development operations.

Attack Path

1. An Agent copies the documented Node.js Makefile template into a project.
2. A required local executable, such as vitest, eslint, prettier, tsx, or tsc, is absent from node_modules/.bin.
3. A developer or automation service runs the corresponding Make target.
4. npx attempts to resolve the missing executable through the configured npm registry.
5. A compromised, malicious, or unexpectedly resolved package is downloaded.
6. The package executable, and potentially applicable package installatio ...[truncated 735 chars]

Remediation

View remediation

Remediation Suggestions

• Declare all required tools in devDependencies using reviewed versions.
• Commit and review the generated dependency lockfile.
• Use npm ci in reproducible build and CI environments rather than permitting ad hoc dependency resolution.
• Replace the commands with package scripts or direct local executable paths such as ./node_modules/.bin/vitest.
• If npx must be retained, use npx --no-install <tool> so execution fails when the tool is not already installed locally.
• Add explicit checks that all expected executables exist under node_modules/.bin before running build targets.
• Configure trusted npm registries explicitly and enforce dependency integrity and package provenance controls in CI.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (18)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 35)May include surrounding context.

go test ./...

clean: rm -rf bin/

First target is the default (runs with bare make)

text

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 97)May include surrounding context.

go test ./...

clean: rm -rf bin/

First target is the default (runs with bare make)

text

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 120)May include surrounding context.

go test ./...

clean: rm -rf bin/

First target is the default (runs with bare make)

text

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 160)May include surrounding context.

go test ./...

clean: rm -rf bin/

First target is the default (runs with bare make)

text

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 390)May include surrounding context.

go test ./...

clean: rm -rf bin/

First target is the default (runs with bare make)

text

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 464)May include surrounding context.

go test ./...

clean: rm -rf bin/

First target is the default (runs with bare make)

text

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 242)May include surrounding context.

npx tsx watch src/index.ts

clean: ## Clean build artifacts rm -rf dist/ node_modules/.cache

text

### Docker

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 75% confidence

Finding

Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 399)May include surrounding context.

md

# OS-specific
[linux]
install-deps:
    sudo apt install -y build-essential

[macos]
install-deps:

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 29% confidence

Finding

I found no actual language or locale restriction in the file. The content is written in English, but it does not instruct the agent to force a specific language or locale on users, so this is not a policy violation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

This markdown skill describes and exemplifies operations such as deploy workflows, package installation, Docker image pushes, and system package installs without any explicit warning that these commands can modify the local system or affect remote environments. For a documentation-style skill that teaches build automation across many contexts, a brief user warning would help set expectations before users adopt targets like deploy, push, or install-deps.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.