Aha Skills Finder

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 9:44 AM UTC
• Version: 1.0.0

Overview

This is a find-only research skill with clear boundaries; the main caution is an optional unpinned upgrade command users should review before running.

Install/use is reasonable for discovery work, but do not treat its candidate output as an adoption or safety recommendation. Review any candidates separately, and avoid running the optional unpinned npx upgrade or unrestricted git pull unless you trust the source and have reviewed the changes.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:328

Finding

Unpinned Remote Package Execution in Upgrade Instructions

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 328–329
Vulnerability Type: Unpinned third-party package and mutable upstream source
Risk Level: Medium

Vulnerable Code

markdown

- **Repository**: https://github.com/its-How/aha-skills-finder
- **Upgrade**: Run `git pull` in the skill directory, or re-run `npx skills add its-how/aha-skills-finder` to get the latest version.

Technical Analysis

The documented upgrade procedure invokes npx skills without pinning the package to a reviewed version or integrity hash. Depending on local npm behavior and cache state, npx may download and execute the currently resolved package from the configured package registry.

The alternative git pull procedure also retrieves mutable upstream content rather than a reviewed commit. Consequently, the effective code and Skill instructions installed during an upgrade can differ from those covered by this audit.

This behavior is not necessary for the Skill’s normal find-stage discovery function. It is an optional maintenance path, but following it crosses a supply-chain trust boundary and can execute or install unreviewed remote content.

Attack Path

1. An attacker compromises the relevant package publisher, package registry path, source repository, maintainer account, or an upstream dependency.
2. The attacker publishes a malicious package version or pushes malicious content to the tracked repository branch.
3. A user or Agent follows the documented npx skills add its-how/aha-skills-finder or git pull upgrade instruction.
4. The mutable remote content is downloaded without a pinned version, commit, or integrity verification.
5. In the npx path, unreviewed package code may execute with the invoking user’s privileges. In either path, malicious Skill instructions or files may be installed and subsequently loaded.

Impact Assessment

Successful exploitation could run attacker-controlled package code with the privileges of the user ...[truncated 547 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the skills package to a reviewed exact version rather than invoking an implicitly resolved latest version.
• Pin the Skill source to a reviewed release tag or immutable commit hash.
• Publish and verify cryptographic checksums or signatures for release artifacts.
• Prefer downloading and inspecting the package before executing any installer.
• Use an isolated, least-privileged environment for installation and upgrade operations.
• Review repository changes before activation instead of applying an unrestricted git pull.
• Document the expected package registry and canonical package identity to reduce dependency-confusion and typosquatting exposure.
• Re-audit changed files after every upgrade and before loading the updated Skill.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 19)May include surrounding context.

md

This is runtime-agnostic. Treat this `SKILL.md` as a portable agent-readable method contract, not as a Codex-only package or an install recipe. Runtime-specific

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The skill includes an upgrade command using npx skills add its-how/aha-skills-finder, which executes code resolved at runtime from a package source without any version pinning or integrity constraint. If the referenced package or one of its transitive dependencies is compromised, renamed, or unexpectedly changed, a user following the instruction could run unreviewed code and suffer supply-chain compromise.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.