Security audit

skill-navigator

Security checks for vulnerabilities and agentic risk

Overview

This skill is a thin, disclosed helper for recommending installed skills, but its installation depends on an unpinned external npm package.

Install this only if you trust the aide-skill-manager npm package and its GitHub repository. For lower risk, prefer a reviewed pinned package version or a pinned source commit, and review what skm setup will write under your Claude and Codex skills directories.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

Location: skillhub.json:14
Finding: Unpinned Global Package and Mutable Source Installation
Content: View full analysis
Remediation: View remediation
``` 2. Publish and document the expected npm integrity digest, provenance information, and release signature. Verify these values before installation. 3. Pin source installations to a reviewed commit rather than executing the mutable default branch: ```bash git clone https://github.com/GrubbyLee/skill-manager.git cd skill-manager git checkout ``` 4. Verify the checked-out commit or release using a trusted signature and compare the installation script against a published checksum before executing it. 5. Avoid global installation where feasible. Prefer a project-local installation or an isolated environment with only the filesystem and network permissions required for catalog recommendation. 6. Include the relevant installer and CLI implementation in the auditable distribution, or provide reproducible-build and provenance records that allow reviewers to verify the code represented by the package. 7. Document all npm lifecycle scripts and filesystem changes performed by `scripts/install.mjs`, `skm setup`, and `skm scan`. 8. Require explicit user confirmation before writing to `~/.claude/skills`, `~/.codex/skills`, or other Agent configuration locations, and create verified backups before modifying existing content. ]]>

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: Line L58 states that when relaying results to the user, the skill should use Chinese. This is a natural-language locale constraint applied to user-facing output, and the file does not offer the user any language choice or explain a justified region-specific requirement.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: 该文档在 L07 以“简体中文 | English”呈现，但当前文件整体内容默认固定为简体中文，没有在技能说明中声明会根据用户偏好选择语言或征求用户同意。按规则，强制特定语言且无 opt-in 可能构成自然语言层面的语言策略违规。
Content: No source excerpt is available for this finding.