Agent Estimation

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 7:31 PM UTC
• Version: 0.1.0

Overview

This skill only teaches an agent a structured way to estimate coding work, with no hidden runtime code or data access, though its install examples should be treated cautiously.

Before installing, prefer a local install over global install, avoid non-interactive flags unless you trust the source, and pin or verify the skills CLI and repository revision when possible. Once installed, expect the skill to change estimation and planning answers into a round-count format.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: README.md:17

Finding

Unpinned Third-Party Package Execution in Installation Instructions

Content

View full analysis

Vulnerability Details

File Location: README.md, lines 17-34
Vulnerability Type: Unpinned third-party dependency execution and mutable supply-chain source
Risk Level: Medium

Vulnerable Code

markdown

The [skills CLI](https://github.com/vercel-labs/skills) is the standard package manager for the open agent skills ecosystem. It works with Claude Code, Cursor, Codex CLI, and [35+ other agents](https://skills.sh).

```bash
# Install to your current project
npx skills add ZhangHanDong/agent-estimation

# Install globally (available across all projects)
npx skills add ZhangHanDong/agent-estimation -g

# Install for a specific agent
npx skills add ZhangHanDong/agent-estimation -a claude-code

# Non-interactive
npx skills add ZhangHanDong/agent-estimation -g -a claude-code -y

text

### Technical Analysis

The installation instructions invoke `npx skills` without specifying an exact package version or integrity digest. Depending on local npm behavior and cache state, `npx` can retrieve the currently published version of the `skills` package and execute its package code with the invoking user's privileges.

The CLI subsequently retrieves Skill content from the mutable personal GitHub repository `ZhangHanDong/agent-estimation`. Neither the CLI package nor the Skill source is pinned to a reviewed immutable version or commit. Consequently, the code and instructions executed or installed at a later date may differ from the content reviewed during this audit.

The global (`-g`) and non-interactive (`-y`) variants increase exposure. Global installation can make remotely retrieved Skill instructions available across projects, while `-y` removes an interactive confirmation opportunity. The project itself contains no executable scripts, credential access, persistence mechanism, or malicious payload; the risk arises specifically from the installation process and its mutable third-party dependencies.

The hyperli
...[truncated 1819 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the CLI to an exact reviewed version, for example npx skills@<reviewed-version>, rather than resolving the latest mutable release.
2. Verify and document the expected npm package publisher, repository, and package identity to reduce dependency-confusion and package-impersonation risk.
3. Pin the Skill source to an immutable Git commit or signed release instead of installing directly from a mutable repository branch.
4. Where supported, verify package integrity using a lockfile, npm integrity metadata, release signatures, or published checksums.
5. Recommend project-local installation by default. Present global installation as an optional action with an explicit explanation of its broader scope.
6. Avoid recommending -y in the primary installation path so users retain an opportunity to inspect and confirm the operation.
7. Instruct users to inspect the downloaded SKILL.md and any scripts before activation, particularly when installing from a personal repository.
8. Document that installation commands should not be run with sudo or another elevated account.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (7)

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 11)May include surrounding context.

md

## The Solution

This skill forces the agent to think in **rounds** (one tool-call cycle: think → write code → execute → verify → fix), estimate round counts per module, apply risk coefficients, and only convert to human wallclock time at the very end.

## Installation

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 87% confidence

Finding

The README instructs users to execute npx skills without pinning an exact package version. That causes retrieval and execution of whatever package version is current at install time, which weakens supply-chain integrity and could expose users to a compromised or malicious upstream release.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 87% confidence

Finding

This command again uses unpinned npx skills, so users may run a different package than the author intended. If the package or one of its distribution paths is compromised, the installation step becomes a code-execution vector on the user's machine.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 87% confidence

Finding

Referencing npx skills without a pinned version introduces nondeterministic package execution during installation. In the context of an agent skill ecosystem, this is especially relevant because users may copy-paste commands directly, increasing exposure to supply-chain attacks.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 87% confidence

Finding

The non-interactive install example still executes an unpinned package from the registry. Because it is designed for automation, it may be used in scripts or unattended setups where a compromised latest version would have broader blast radius and fewer chances for human review.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 87% confidence

Finding

This repeated pattern continues to normalize running remote package code without version pinning. Even though the README is documentation rather than executable code, installation instructions are operationally sensitive because users commonly execute them verbatim.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The README says the skill activates automatically for broad categories like estimate, scope, or plan work. That trigger surface is very common in normal developer conversations, so the skill may engage unexpectedly, influence unrelated workflows, or crowd out higher-priority instructions in contexts where it was not explicitly requested.

Content

No source excerpt is available for this finding.