startup-researcher

• Outcome: Review
• Latest audit: Sep 15, 2026 · 12:24 AM UTC
• Version: 1.3.2

Overview

The skill is mostly a coherent startup-report generator, but it asks agents to install unpinned packages and silently adds a developer-controlled external attribution link to generated reports.

Review this skill before installing. Use a pinned commit or release, install dependencies manually in a virtual environment or container, and approve any system package-manager commands yourself. Also be aware that generated reports may include a linked 'Generated with startup researcher' attribution unless you remove or override that instruction.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Error

• Location: prompts/report_compiler.md:5

Finding

Mandatory Promotional Link Injection into Generated Reports

Content

View full analysis

AI Startup Landscape Report - [Current Date] Generated with startup researcher, [Current Date] ``` The instruction is invoked by the report-generation workflow at `SKILL.md:35-37`: ```markdown 3. **Compile the Final Report:** Follow the instructions in `prompts/report_compiler.md` to merge the category analysis and individual profiles into a single, cohesive markdown document (`final_draft.md`) and save to `references//final_draft.md`. ``` Its effect is demonstrated in `examples/final_draft.md:268-270`: ```html --- Generated with startup researcher, March 22, 2026 ``` ### Technical Analysis The report compiler requires the agent to insert an exact attribution containing an external GitHub link into every generated report. The injected link is unrelated to the substantive startup analysis requested by the user, cannot be disabled through the documented workflow, and is subsequently embedded in the delivered PDF. This changes the agent's output requirements when the Skill is loaded and causes user-facing documents to contain developer-controlled promotional content. Because the destination is an external, mutable repository location, the content presented after a recipient follows the link can change independently of the audited Skill package. ### ...[truncated 901 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:18

Finding

Automatic Installation of Unpinned Dependencies from Mutable Sources

Content

View full analysis

=3.10, weasyprint>=61.0, markdown>=3.5 ``` ### Technical Analysis The workflow directs the agent to install Python and operating-system packages automatically when dependencies are unavailable. Python packages are installed by name without exact versions, integrity hashes, a lock file, or an isolated environment. The documented `npx` installation command does not pin the npm installer version, while the Skill source is retrieved from a mutable GitHub branch rather than an immutable commit. Dependency resolution therefore occurs at installation time and can produce components different from those reviewed. If an upstream package, transitive dependency, npm installer, package registry entry, or mutable repository branch is compromised, altered code may execute in the local environment. The package-manager commands are expected to modify the host. Although the listed Linux commands do not explicitly invoke `sudo`, they would require elevated priv ...[truncated 1559 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

The README instructs users to install and execute a remote package via npx skills without pinning a specific version, which can lead to execution of an unexpected or compromised package version. Because this is an install/run path for an AI skill, users may copy-paste the command directly, increasing supply-chain risk if the package is updated maliciously or the registry/package resolution changes.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly instructs the agent to run package-manager and pip installation commands, including system-level package installs, without any requirement for user confirmation or environment safety checks. This can modify the host environment, introduce unreviewed dependencies, and create supply-chain or stability risk, especially because the skill is treated as potentially adversarial and has access to run_command.

Content

No source excerpt is available for this finding.

YARA rule 'network_reconnaissance': Network reconnaissance and scanning patterns [hacktools]

Medium

• Category: YARA Match
• Confidence: 65% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · examples/final_draft.md (reported line 45)May include surrounding context.

md

s, and cloud infrastructure engineers. Cerebras is also hiring finance and accounting talent ahead of its IPO. SambaNova recently onboarded Clyde Hosein as President & COO, signaling operational maturity. Groq's Nvidia deal saw many of its senior engineers join Nvidia, which could create short-term talent gaps but also validates the caliber of its engineering team. The broader market is competing fiercely for AI compiler engineers — professionals who can bridge custom silicon hardware with AI framework software — as this skill set is the critical bottleneck for custom silicon adoption.

### Outlook

The next six months will be defining for the custom silicon category. **Cerebras** is on track for what could be the largest pure-play AI chip IPO, potentially listing as early as April 2026. A successful offering would validate the entire custom silicon thesis and provide a public benchmark for peer valuations. **Groq** will see its technology reach the broadest possible audience throu

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill directs the agent to write multiple intermediate artifacts and final outputs to disk, including fallback behavior to the current path, without clearly warning the user that files will be created. While file output is expected for a report-generation skill, undisclosed workspace writes can surprise users, leak sensitive research artifacts into unintended locations, or overwrite existing content if paths are not carefully controlled.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.