Defuddle (kepano)

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 4:50 AM UTC
• Version: 1.0.0

Overview

This skill is a simple webpage-to-markdown helper, but users should be careful about the global npm install and only use it on intended public web URLs.

Before installing, consider using a pinned or local Defuddle installation instead of a global latest-version npm install. Use the skill only for web pages you intentionally want fetched and summarized, especially avoiding private-network, localhost, credential-bearing, or sensitive internal URLs unless you understand the exposure.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:10

Finding

Unpinned Global Installation of a Third-Party npm Package

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 10
Vulnerability Type: Insecure third-party dependency installation
Risk Level: Medium

Vulnerable Code:

markdown

If not installed: `npm install -g defuddle`

Technical Analysis

The skill directs the agent to install the latest available release of the defuddle npm package globally. The dependency is not pinned to a reviewed version, protected by a lockfile, or verified using an expected package integrity value.

Because npm packages can define installation lifecycle scripts, package-controlled code may execute with the permissions of the user running npm. The -g option also expands the installation scope beyond the project, even though a project-local or ephemeral installation would be sufficient for webpage extraction.

The audit did not establish that the named package is malicious. The vulnerability is the unsafe, mutable dependency acquisition process: a compromised maintainer account, malicious future release, registry compromise, or other supply-chain incident could change the code executed after the skill has already been reviewed.

Attack Path

1. The skill is invoked for a webpage extraction task.
2. The agent determines that the defuddle executable is not installed.
3. Following SKILL.md, it runs npm install -g defuddle.
4. npm resolves the current registry release rather than a specifically reviewed version.
5. If that release or one of its transitive dependencies has been compromised, package installation scripts or subsequently invoked CLI code execute locally.
6. The malicious code operates with the invoking user's permissions and may access files, credentials, environment variables, and network resources available to that user.

Impact Assessment

Successful exploitation could provide arbitrary code execution under the account performing the installation. The accessible scope includes that user's readable ...[truncated 667 chars]

Remediation

View remediation

Remediation Suggestions

• Pin defuddle to a specific, reviewed version rather than resolving the mutable latest release.
• Prefer a project-local installation with a committed lockfile over npm install -g.
• Verify package provenance and integrity against an approved registry and expected integrity digest.
• Disable npm lifecycle scripts during installation where compatible, then explicitly permit only installation steps shown to be necessary.
• Run the package with the least-privileged account in a restricted environment that limits filesystem, credential, and network access.
• Establish a dependency update process that reviews new versions and transitive dependency changes before changing the pin.
• If ephemeral execution is required, invoke an explicitly pinned version in a sandbox rather than relying on a persistent global executable.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill is explicitly described as something to use whenever a user provides a URL to read or analyze, which is an overly broad trigger. That can cause the agent to fetch arbitrary attacker-controlled URLs, including internal-only endpoints or sensitive locally reachable services, creating SSRF-style risk or unintended retrieval of untrusted content.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.