Feature Forge

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:41 PM UTC
• Version: 0.1.2

Overview

This skill appears intended for legitimate full-stack feature generation, but it gives agents broad file-changing and commit authority without an explicit user approval checkpoint.

Review this skill before installing. It is not showing exfiltration or destructive intent, but use it only in repositories where you are comfortable with automated file edits, local tool execution, and git commits. Prefer requiring a visible plan, a diff review, and project-pinned package-manager scripts before allowing npx commands or commits.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:63

Finding

Unpinned Package Execution Through npx

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 63
Vulnerability Type: Supply-chain exposure through unpinned package execution
Risk Level: Medium

Vulnerable Code

markdown

- Regenerate types: `npx supabase gen types typescript --local > src/lib/supabase/types.ts`.

Technical Analysis

The skill instructs the agent to execute the Supabase CLI through npx without requiring a locally installed, lockfile-resolved package or pinning an exact reviewed version. When no suitable local executable exists, npx may retrieve and execute a package from the configured package registry.

This makes the executed code dependent on mutable external registry content rather than only on dependencies already reviewed and locked by the target project. A compromised package release, registry account, registry endpoint, or package-resolution configuration could therefore introduce arbitrary code into the skill workflow.

The command is especially sensitive because the skill has filesystem permission and declares access to inherited environment variables. Package installation and CLI startup code execute with the same operating-system privileges as the agent process.

Attack Path

1. A user requests a feature that requires a database schema or generated Supabase types.
2. The skill follows its database workflow and invokes the documented npx supabase command.
3. The target project does not contain a trusted local Supabase CLI executable, or package resolution is influenced by a malicious registry configuration.
4. npx retrieves a mutable or compromised package from the configured registry.
5. Package lifecycle logic or CLI startup code executes under the agent's identity.
6. The malicious code can access files writable or readable by that identity, inspect inherited environment data, alter generated project files, or execute additional processes.

Impact Assessment

Successful exploitation could provide arbitrary code execution with ...[truncated 684 chars]

Remediation

View remediation

Remediation Suggestions

1. Require the Supabase CLI to be declared in the project's development dependencies with an exact or appropriately constrained version and committed lockfile.

2. Invoke only the lockfile-resolved local binary. For example, use an offline package-manager mode such as:

   bash

   npm exec --offline -- supabase gen types typescript --local
   

3. Before execution, verify that the resolved executable belongs to the expected package and comes from the project's local dependency tree.

4. Do not permit automatic registry downloads during feature generation. If installation is necessary, obtain explicit user approval and install an exact reviewed version.

5. Use trusted registry configuration and package integrity verification.

6. Run code-generation tools in a restricted environment with minimal filesystem, environment-variable, process, and network access.

7. Apply the same lockfile-backed and offline-execution requirement to other npx commands documented by the skill, including TypeScript compiler invocations.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (7)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest description and introductory text say the skill activates when 'the user describes a feature' and will implement the 'complete vertical slice autonomously,' but they do not define specific trigger phrases, contexts, or exclusion conditions. This is broad enough to overlap with ordinary development conversations and could cause unintended invocation.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 87% confidence

Finding

The skill instructs running npx tsc --noEmit during execution without pinning a package version or requiring use of a locally installed toolchain. In environments where typescript is not already locked in the repository, npx may resolve and execute code from the registry, creating supply-chain and reproducibility risk during a workflow that is supposed to generate features.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill claims it only generates source code and does not read secrets, but its workflow also directs local command execution, verification steps, and repository mutation. This mismatch reduces operator trust and can cause users to approve the skill under a narrower risk model than the behavior actually described.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

Automatic git commits are not necessary to satisfy the core function of generating feature code, and they create an unnecessary persistence mechanism for unintended or malicious changes. Committing without an explicit approval gate can make rollback, review, and attribution harder in automated or semi-automated workflows.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill instructs repository mutations and an eventual commit without an explicit warning or confirmation checkpoint immediately before those actions. In an adversarial or mistaken prompt context, this increases the likelihood of unauthorized code changes being written and persisted before the user can meaningfully review them.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The instruction npx supabase gen types typescript --local invokes a CLI by name without pinning a version. If the CLI is fetched dynamically or differs from the repository's expected version, the skill may execute unreviewed third-party code and generate inconsistent schema artifacts, increasing both supply-chain and integrity risk.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The manifest describes generating feature artifacts, but the instructions also require running local commands such as TypeScript checks, Supabase type generation, tests, and linters. While verification can be helpful, arbitrary command execution is a broader operational capability than the manifest advertises and should be declared when present.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.