A/B Testing Tool Skill

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:21 AM UTC
• Version: 1.0.0

Overview

This A/B testing skill is mostly coherent, but its CLI can escape its intended test-storage folder and read or overwrite other JSON files the user can access.

Review before installing. The skill does not show deception or exfiltration, but use only trusted test names and avoid running it in directories or accounts that can access sensitive JSON files until path validation and dependency pinning are fixed.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: index.js:37

Finding

Path Traversal Through Unsanitized Test Names Enables File Access Outside the Tests Directory

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The description says to use the skill whenever a user wants to test content, measure performance, or make data-driven decisions, which is broad enough to trigger in many unrelated contexts. Overly broad invocation criteria can cause the agent to select this skill unnecessarily, leading to irrelevant tool use, unintended data handling, or actions taken without the user explicitly requesting A/B testing.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This code contains user-facing and instructional natural language in Chinese comments such as the section headers, while the rest of the CLI is in English and there is no indication that the skill is intentionally region-specific. The policy requires avoiding forced language/locale behavior without user opt-in or clear justification.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 93% confidence

Finding

The dependency uses a caret range, which permits automatic installation of newer minor/patch releases rather than a single audited version. This weakens supply-chain integrity because builds are not fully reproducible and a later compromised or vulnerable upstream release could be pulled in without review.

Content

Scanner excerpt · package.json (reported line 18)May include surrounding context.

json

"author": "",
  "license": "MIT",
  "dependencies": {
    "commander": "^12.0.0",
    "chalk": "^4.1.2",
    "fs-extra": "^11.2.0"
  }

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The chalk dependency is not pinned and is allowed to float within the semver range, which is especially risky here because there is a known advisory affecting some chalk releases. Without exact version pinning and a lockfile, installs may resolve to an affected or malicious version, creating a supply-chain exposure.

Content

Scanner excerpt · package.json (reported line 19)May include surrounding context.

json

"license": "MIT",
  "dependencies": {
    "commander": "^12.0.0",
    "chalk": "^4.1.2",
    "fs-extra": "^11.2.0"
  }
}

Unverifiable Dependency: chalk has 1 known advisory(ies) (MAL-2025-46969 (Malicious code in chalk (npm))), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The manifest references chalk without pinning an exact version, while static analysis notes a known malicious-package advisory for chalk. Because the exact installed release cannot be verified from this manifest alone, consumers may resolve to an affected version, making this a real supply-chain risk.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 92% confidence

Finding

The fs-extra dependency is specified with a caret range, so different environments may install different code over time. That lack of determinism increases the chance of silently ingesting a vulnerable or compromised release from the package ecosystem.

Content

Scanner excerpt · package.json (reported line 20)May include surrounding context.

json

"dependencies": {
    "commander": "^12.0.0",
    "chalk": "^4.1.2",
    "fs-extra": "^11.2.0"
  }
}

Static analysis

No suspicious patterns detected.