Find Skills

• Outcome: Review
• Latest audit: Sep 11, 2026 · 4:40 AM UTC
• Version: 1.0.0

Overview

This skill is meant to find and install other skills, but it recommends broad triggering plus unpinned, auto-confirmed global installs that can change the user's agent environment.

Review carefully before installing. Prefer a pinned, trusted Skills CLI version, inspect the source skill before adding it, avoid '-g' and '-y' by default, and require explicit confirmation before installing or updating skills that can affect future agent sessions.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:14

Finding

Unpinned CLI Executes and Globally Installs Unverified Third-Party Skills

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:14-17 and SKILL.md:55-58
Vulnerability Type: Unpinned dependency execution and installation from unverified sources
Risk Level: Medium

The skill instructs the agent to execute an unpinned npm CLI package and install third-party skills globally with automatic confirmation.

bash

npx skills find [query]    # Search for skills interactively or by keyword
npx skills add <package>   # Install a skill from GitHub or other sources
npx skills check           # Check for skill updates
npx skills update          # Update all installed skills

bash

npx skills add <owner/repo@skill> -g -y

Technical Analysis

The npx skills invocation does not specify a reviewed package version or integrity value. Depending on the local npm environment, npx can retrieve and execute the currently published version of the package. Consequently, the executable code used by this workflow may change after the skill itself has been audited.

The installation source is also described as GitHub or unspecified “other sources.” The instructions do not require repository verification, immutable commit references, content inspection, signature validation, or integrity checks before installation. The recommended -g -y flags increase risk by installing the selected skill globally and suppressing interactive confirmation.

This creates a supply-chain trust gap: compromise of the CLI package, a third-party skill repository, or a misleading search result could cause the agent to install attacker-controlled code or instructions.

Attack Path

1. An attacker publishes, replaces, or compromises a package or skill discoverable by the Skills CLI.
2. The malicious entry appears in search results or its package identifier is supplied to the agent.
3. The agent runs the unpinned npx skills CLI, potentially downloading and executing a release that was not reviewed with ...[truncated 1043 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the CLI to a reviewed version, such as npx skills@<approved-version>, and enforce the expected package integrity through a lockfile or equivalent verification mechanism.
2. Permit installations only from an explicit allowlist of trusted repository owners and repositories.
3. Resolve skills to immutable commit hashes or signed releases rather than mutable branches or tags.
4. Download and inspect each skill's instructions, scripts, manifests, and dependency declarations before installation or execution.
5. Require explicit user approval after presenting the exact source, version or commit, requested scope, and security review results.
6. Remove -y from the default workflow so security-relevant installation prompts are not automatically accepted.
7. Avoid -g by default. Prefer a project-local, isolated, least-privilege installation that can be removed after use.
8. Disable or tightly control automatic bulk updates because they can replace reviewed versions with newly published, unreviewed content.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (17)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The activation description is extremely broad, covering common requests like 'how do I do X' and 'can you do X', which can cause the skill to trigger in many unrelated conversations. Over-broad activation increases the chance that users are steered toward external package search/install flows unexpectedly, expanding exposure to supply-chain and unwanted capability-extension risks.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The skill repeatedly instructs use of npx skills without pinning a specific package version, which causes code to be fetched and executed from the registry at runtime. This creates a supply-chain risk: a compromised latest release, typosquat, or dependency hijack could lead to arbitrary code execution on the user's machine during skill discovery or installation.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

This command references npx skills without a pinned version, so the executed package may change over time and can be replaced by a malicious upstream publish. Because npx executes fetched code, this is effectively an unverified remote code execution path.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

Using npx skills add <package> without pinning the CLI version leaves the command dependent on whatever package version is current at execution time. That exposes users to supply-chain compromise and inconsistent behavior, especially because this skill's purpose is to install more code from external sources.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

An unpinned npx skills check command still executes remote package code and inherits the same mutable-supply-chain risk as install commands. Even though the action is read-oriented, compromise of the package could still execute arbitrary code locally.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The unpinned npx skills update command can execute a mutable upstream CLI and then update installed skills, multiplying supply-chain exposure. A malicious package version could both run arbitrary code and alter the user's environment by updating installed components.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The search instruction uses npx skills find without a version pin, again allowing arbitrary package changes at execution time. Because users are told to rely on this command as part of normal workflow, the attack surface is frequent and attractive for supply-chain abuse.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The example command npx skills find react performance is a concrete instance of executing an unpinned remote package. Examples materially encourage unsafe copy-paste behavior, increasing the likelihood that users run mutable code without scrutiny.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

This example repeats the unsafe unpinned npx skills pattern and invites users to execute it directly. Since the skill aims to help discover more installable content, compromise here can become a gateway to further malicious package installation.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The example search command at this line still executes npx skills without version control, preserving the same registry and dependency substitution risk. The risk is amplified by making unsafe usage look routine and endorsed.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence

Finding

The install example npx skills add <owner/repo@skill> is especially risky because it combines an unpinned CLI with installation of third-party skill content from external sources. This creates a dual supply-chain problem: the CLI itself and the installed skill can both be compromised.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

This line recommends npx skills add <owner/repo@skill> -g -y, combining unpinned remote execution with global installation and auto-confirmation. That allows arbitrary code fetched at runtime to make system-wide changes without interactive user review, significantly increasing exploitation impact.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The instructions recommend auto-confirmed global installation without an explicit warning that it will modify the user's system. This bypasses a meaningful user consent checkpoint and can lead to unintended or attacker-influenced system-wide changes if a malicious or inappropriate skill is selected.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 96% confidence

Finding

The presence of -y enables autonomous decision-making by suppressing interactive confirmation for installation. In the context of installing external skills, this makes the behavior more dangerous because the agent can effectively commit the user to executing system-modifying actions without a robust consent step.

Content

Scanner excerpt · SKILL.md (reported line 69)May include surrounding context.

Step 4: Offer to Install

Install with global flag and auto-confirm:

bash

npx skills add <owner/repo@skill> -g -y

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.