Security checks for vulnerabilities and agentic risk
Overview
The skill is a coherent Reply.io CLI helper, but it asks agents to run an unpinned npm package with a Reply.io API key and includes high-impact campaign/contact changes without clear guardrails.
Review before installing. Use only with a Reply.io API key scoped as narrowly as possible, prefer a pinned or preinstalled reviewed `reply-cli` instead of live `npx` resolution, and require explicit approval before any command that starts or pauses sequences, creates contacts, or changes enrollment.
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
T08 · Insecure Dependencies
Warning
Location
reply.sh:14
Finding
Unpinned npm Package Execution Through npx
Content
View full analysis
Vulnerability Details
File Location: reply.sh, line 14 Vulnerability Type: Unpinned third-party dependency execution Risk Level: Medium
Vulnerable Code:
bash
# Pass all arguments to reply-cli
npx reply-cli "$@"
Technical Analysis
The wrapper invokes reply-cli through npx without specifying an exact package version or enforcing use of an already installed, audited copy. If the package is not available locally, npx may resolve, download, and execute it from the configured npm registry.
Consequently, the code executed at runtime can differ from the code reviewed during this audit. It may change through a compromised package release, package ownership transfer, registry compromise, or manipulated registry configuration. The external package's source and dependency tree are not included in this project, so their behavior could not be verified.
This is particularly sensitive because the child process inherits the wrapper's environment, including REPLY_API_KEY. The argument forwarding itself is correctly quoted and does not create a shell-injection issue.
Attack Path
An attacker compromises the reply-cli package, its publisher account, an upstream dependency, or the npm registry resolution path.
The attacker publishes or serves a malicious version under the package name used by the Skill.
A user or agent invokes reply.sh on a system without a trusted local installation.
npx resolves and executes the malicious package.
The package runs with the invoking agent's operating-system privileges and inherits REPLY_API_KEY.
The malicious code can exfiltrate the key, access data available to the process, or issue unauthorized Reply.io API operations.
Impact Assessment
Successful exploitation can expose the Reply.io API key and permit actions authorized by that credential, potentially including reading campaign and contact data, modifying contacts, enrollin
...[truncated 407 chars]
Remediation
View remediation
Remediation Suggestions
Add a package manifest and lockfile that pin reply-cli and all transitive dependencies to reviewed versions.
Install dependencies during a controlled build or deployment phase rather than downloading packages during Skill execution.
Invoke the pinned local binary directly, or use:
bash
npx --no-install reply-cli "$@"
This causes execution to fail instead of retrieving an absent package.
Verify package provenance, registry configuration, and integrity metadata during installation.
Run the command in a restricted environment with only the necessary REPLY_API_KEY exposed.
Scope and rotate the Reply.io API key where supported, and avoid granting permissions unrelated to the declared campaign-management functions.
Consider vendoring or otherwise reviewing the exact downstream CLI implementation before deployment.
The skill repeatedly instructs users to run npx reply-cli without pinning a specific package version. Because npx resolves and executes the latest published package by default, a compromised upstream release, typosquat, or malicious dependency update could result in arbitrary code execution in the agent environment, with access to REPLY_API_KEY and network capabilities.
Content
No source excerpt is available for this finding.
Rp1
Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding
This command uses npx reply-cli without a pinned version, causing on-demand execution of whatever version the package registry returns at runtime. In a skill that relies on an API key, this materially increases supply-chain risk because a malicious package update could steal credentials or perform unauthorized Reply.io actions.
Content
No source excerpt is available for this finding.
Rp1
Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding
Invoking npx reply-cli here executes an unpinned package from the npm ecosystem, which is a classic supply-chain exposure. If the package or one of its dependencies is hijacked, the malicious code could run with the user's environment and access the Reply.io API key.
Content
No source excerpt is available for this finding.
Rp1
Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding
The skill recommends an unpinned npx execution path for a command that can inspect or manage Reply.io resources. This creates avoidable exposure to remote code execution via malicious package publication or dependency drift, especially dangerous because the runtime has a sensitive API token configured.
Content
No source excerpt is available for this finding.
Missing User Warnings
Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding
The documentation presents several state-changing commands—starting/pausing sequences, creating contacts, adding/removing sequence contacts—without clear warnings, confirmations, or safety constraints. In an agent setting, this can lead to unintended outreach, contact-data modification, or operational disruption because the commands appear as routine examples alongside read-only operations.
Content
No source excerpt is available for this finding.
Rp1
Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding
An unpinned npx reply-cli invocation allows mutable third-party code to be fetched and executed each time the skill is used. In this context, that code could exfiltrate REPLY_API_KEY, read command inputs, or make unauthorized campaign changes through the Reply.io API.
Content
No source excerpt is available for this finding.
Rp1
Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding
Using npx reply-cli without version pinning exposes the environment to npm supply-chain compromise. Even though this example is a stats command, the fetched code runs before the intended CLI action and can access environment variables and network egress.
Content
No source excerpt is available for this finding.
Rp1
Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding
This unpinned npx example creates the same supply-chain risk as the other occurrences: arbitrary package code may run with access to Reply.io credentials. Because contact-related commands often involve customer data, compromise could also expose personal information in addition to account access.
Content
No source excerpt is available for this finding.
Rp1
Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding
The command executes a mutable npm package via npx, enabling remote code execution if the package source is compromised. In the skill's context, that code could harvest contact data and the API key or issue unauthorized Reply.io operations.
Content
No source excerpt is available for this finding.
Rp1
Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding
This npx reply-cli invocation is unpinned and is used for a state-changing operation that adds a contact to a sequence. A malicious or replaced package could not only run arbitrary code but also abuse the authenticated Reply.io session to alter outreach activity at scale.
Content
No source excerpt is available for this finding.
Rp1
Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding
Running npx reply-cli unpinned for a create-and-enroll action combines supply-chain execution risk with an operation that can directly affect customer outreach. If upstream code is compromised, it could silently create contacts, enroll them in campaigns, or exfiltrate contact metadata and credentials.
Content
No source excerpt is available for this finding.
Rp1
Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding
This example uses unpinned npx for a removal action, so package compromise could lead to arbitrary code execution and unauthorized changes to campaign membership. The risk is amplified by the presence of REPLY_API_KEY, which grants API access once the package starts.
Content
No source excerpt is available for this finding.
Rp1
Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding
The skill instructs listing connected email accounts through an unpinned npx command, exposing the runtime to code from a mutable npm package. Compromised code could enumerate accounts, exfiltrate metadata, and steal the Reply.io API key before returning normal-looking output.
Content
No source excerpt is available for this finding.
Rp1
Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding
This npx reply-cli schedule-listing example still executes untrusted mutable package code prior to the intended action. The surrounding skill context includes privileged API access, making package compromise more dangerous than a normal local utility invocation.
Content
No source excerpt is available for this finding.
Rp1
Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding
The usage guideline broadly tells the agent to use npx reply-cli workflows but does not constrain versioning, reinforcing insecure execution practices throughout the skill. This increases the likelihood that any future use of the skill will run mutable third-party code with sensitive environment access.
Content
No source excerpt is available for this finding.
Rp1
Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding
This line's guidance relies on the same unpinned CLI ecosystem usage, preserving supply-chain risk in contexts where the agent parses returned data. Because the CLI runs with REPLY_API_KEY, a malicious update could tamper with output, steal credentials, or trigger hidden API actions.
Content
No source excerpt is available for this finding.
Rp1
Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding
The recommendation to use the CLI for performance and stats depends on the same unpinned npx execution model, which is unsafe in an authenticated automation context. Even read-oriented workflows can be abused because malicious package code executes before any legitimate command processing and can access secrets and outbound network connectivity.
Content
No source excerpt is available for this finding.
Rp1
Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding
Using npx reply-cli without a pinned package version allows npm to resolve and execute whatever version is current at runtime, and may even fetch code from the registry if the package is not already installed locally. In a credentialed CLI wrapper like this one, that creates a supply-chain execution risk: a compromised, typosquatted, or newly malicious package version could run arbitrary code and access the REPLY_API_KEY loaded by the script.
