Security audit

pubmed2blog

Security checks for vulnerabilities and agentic risk

Overview

The skill does the described PubMed-to-blog work, but its default agent workflow includes unsafely scoped recurring cron execution and a mutable global npm install.

Review before installing. Prefer a pinned, locally isolated version of the CLI; run setup in a dedicated workspace; avoid giving broad filesystem access; and do not let an agent create cron jobs unless you explicitly approve the exact command, schedule, credential source, output location, cost expectations, and removal process.

A.I.G

Vulnerability Patterns

System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

Location: SKILL.md:1
Finding: Unpinned Global Installation of an Unaudited npm Executable<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 1–7 **Vulnerability Type**: Supply-chain risk through an unpinned third-party dependency **Risk Level**: High ### Vulnerable Code ```yaml --- name: pubmed2blog description: Transform PubMed papers into SEO-optimized healthcare blog articles bins: - pubmed2blog install: npm install -g pubmed2blog requires: [] --- ``` The installation instruction also appears in `SKILL.md`, lines 66–73: ```markdown ## Setup ```bash npm install -g pubmed2blog pubmed2blog init ``` Supports Anthropic, OpenAI, and Z.AI providers. ``` ### Technical Analysis The skill instructs users or agents to install the latest available version of `pubmed2blog` globally from the npm registry. It does not specify an exact version, package integrity hash, lockfile, verified publisher, or trusted source repository. As a result, the code executed by this skill can change without any corresponding modification to the audited `SKILL.md`. npm installation may also execute package lifecycle scripts, such as `preinstall`, `install`, or `postinstall`, with the privileges of the user running npm. Global installation expands the package's reach by placing its executable in a shared command path. The project contains no source code for the dependency, so the behavior of the installed CLI and its installation scripts could not be independently audited. This does not establish that the current package is malicious, but it creates an unsafe dependency and supply-chain boundary. ### Attack Path 1. An attacker compromises the npm package, its publisher account, or a future package release. 2. The attacker publishes a modified version containing malicious lifecycle or runtime code. 3. An agent or user follows the skill instruction and executes `npm install -g pubmed2blog`. 4. npm retrieves the current mutable release rather than a previously audited exact version. 5. Malicious lifecycle code can execute during installation, or mali ...[truncated 969 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin the dependency to a reviewed exact version, for example: ```bash npm install --global pubmed2blog@X.Y.Z ``` 2. Document the expected npm registry, package publisher, and canonical source repository. 3. Verify package provenance and integrity before installation, using registry provenance data and a known cryptographic integrity value where available. 4. Prefer a project-local dependency over global installation: ```bash npm install --save-exact pubmed2blog@X.Y.Z ``` Invoke it through a verified local path or `npm exec` with controls that prevent retrieval of an unexpected version. 5. Commit an appropriate lockfile when using a local dependency. 6. Audit the package source and all transitive dependencies for the pinned release. 7. Review lifecycle scripts before installation. Disable scripts with `--ignore-scripts` if the package does not require them. 8. Run the CLI under a dedicated least-privilege account or isolated environment with access only to required files. 9. Store AI-provider credentials in a restricted secret store and provide only the specific credentials required for each invocation. 10. Establish an explicit update process in which new dependency versions are reviewed and tested before changing the pin. ]]>

T06 · System Persistence

Warning

Location: SKILL.md:55
Finding: Unrestricted Guidance to Establish Recurring Cron Execution<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 55–62 **Vulnerability Type**: Cross-session persistence through scheduled execution **Risk Level**: Medium ### Vulnerable Code ```markdown ## Agent Usage When using this skill as an agent: 1. Run `pubmed2blog discover <keyword>` to find relevant papers 2. Use `pubmed2blog extract <pmid>` to get full details 3. Generate with `pubmed2blog generate <pmid> --type <type> --save` 4. Deliver results to user in chat 5. Schedule via cron for regular content generation ``` ### Technical Analysis The agent instructions recommend scheduling the CLI through cron without requiring explicit user authorization or defining security controls. No fixed executable path, exact dependency version, execution identity, schedule, working directory, output destination, logging policy, credential mechanism, or removal procedure is provided. A cron entry survives the original skill invocation and causes unattended, cross-session execution. This also compounds the dependency risk because the recommended globally installed executable can later resolve to modified package code while the scheduled task continues to run. The instruction does not itself create a cron entry and therefore is not proof that persistence has already been installed. However, an agent following the documented workflow may create persistent execution as a normal step without sufficient user awareness or safeguards. ### Attack Path 1. An agent loads the skill and follows its documented agent-usage sequence. 2. After generating content, the agent interprets step 5 as authorization to create a cron entry. 3. The cron entry invokes the globally installed `pubmed2blog` executable on a recurring schedule. 4. The process runs after the original interaction has ended and may inherit or retrieve stored API credentials. 5. If the executable, configuration, search terms, or package version is later modified, cron repeatedly executes the changed beha ...[truncated 1002 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove cron scheduling from the default agent workflow. 2. Require explicit, informed user authorization before creating any persistent or recurring task. 3. Present the exact command, frequency, execution account, output location, expected API usage, and estimated cost before requesting approval. 4. Use a fixed absolute path to a locally installed, version-pinned, integrity-verified executable. 5. Run scheduled generation under a dedicated least-privilege account with narrowly restricted filesystem and network access. 6. Avoid embedding API keys directly in crontab entries or command-line arguments. Retrieve credentials from a protected secret store at runtime. 7. Set a controlled working directory, restrictive file permissions, resource limits, timeout, and explicit logging and error-handling policies. 8. Ensure generated filenames and other command arguments cannot introduce shell metacharacters or command injection. 9. Provide commands for users to inspect, disable, and permanently remove the scheduled task. 10. Prefer a scheduler that supports approval, audit logs, secret isolation, execution history, and automatic expiration. 11. Configure an expiration date or bounded run count so the task does not persist indefinitely by default. ]]>

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Low

Confidence: 94% confidence
Finding: The skill explicitly instructs agents to run `pubmed2blog generate <pmid> --type <type> --save` without warning that this writes output to disk. In an agent context, undocumented file creation can violate user expectations, clutter the workspace, or overwrite existing content depending on tool behavior, even if the command appears routine and content-focused.

Static analysis

No suspicious patterns detected.