GSD CLI (→ gsd-orchestrator)

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:44 AM UTC
• Version: 1.0.0

Overview

This placeholder skill mainly redirects users elsewhere, but it also declares an automatic Node package install that is not needed for that stated purpose.

Review this carefully before installing. The visible skill content only redirects to `gsd-orchestrator`, so the declared `gsd-pi` Node package install is not proportionate to the placeholder purpose. Prefer installing the real `gsd-orchestrator` skill directly, or only proceed with this package if you separately trust the `gsd-pi` package and the installer behavior in your environment.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:8

Finding

Unnecessary Third-Party Package Installation in Placeholder Skill

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 8–13
Vulnerability Type: Unnecessary third-party dependency and supply-chain exposure
Risk Level: Medium

yaml

requires:
  bins: [gsd]
install:
  kind: node
  package: gsd-pi
  bins: [gsd]

Technical Analysis

The project describes itself solely as a name-reservation placeholder that redirects users to the separate gsd-orchestrator Skill. It contains no executable implementation and no command that uses the declared gsd binary. Despite this, its metadata directs the Skill manager to install the third-party Node package gsd-pi when the binary is unavailable.

Installing an unnecessary package expands the trusted computing base and introduces avoidable npm supply-chain exposure. Depending on the package manager and installation configuration, package lifecycle scripts may execute code with the privileges of the user or service performing the installation. The package implementation is not included in this project and therefore could not be audited here.

There is no evidence in the reviewed file that gsd-pi is malicious. The vulnerability is the unnecessary and unaudited dependency installation, not a confirmed malicious payload.

Attack Path

1. A user or automated agent selects or resolves this placeholder Skill.
2. The Skill manager evaluates the requires.bins declaration and determines that gsd is unavailable.
3. The installer retrieves and installs the declared gsd-pi package from the configured Node package registry.
4. Package code, including any enabled lifecycle scripts, may run under the installer process's privileges.
5. If the dependency or its distribution channel is compromised, malicious package code could act within those privileges even though this placeholder Skill does not require the binary.

This attack path is conditional on automatic dependency installation, lifecycle-script behavior, and compromise ...[truncated 623 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the requires and install metadata from this name-reservation placeholder because it does not execute or depend on the gsd binary.
2. Retain only the clearly disclosed redirect instructing users to install gsd-orchestrator.
3. If the dependency is genuinely required in a future implementation:
   • Document the exact functionality that requires it.
   • Pin an exact, reviewed package version rather than relying on an unbounded package resolution.
   • Verify package provenance and integrity using registry-supported integrity controls or a trusted lockfile.
   • Disable package lifecycle scripts where operationally possible.
   • Perform installation using a minimally privileged account in an isolated environment.
   • Review the package and its transitive dependencies before publication.
4. Add a release check that rejects dependencies unused by any command or implementation contained in the Skill.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.