Color

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 10:51 PM UTC
• Version: 1.0.0

Overview

This color-design skill is coherent and low-risk, with one disclosed caution around optional unpinned npx conversion examples.

The skill is reasonable to install for color-system guidance. Before running its optional npx examples, pin or review the package version and run commands only in a trusted, least-privilege environment.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: commands.md:48

Finding

Unpinned Third-Party Package Execution Through npx

Content

View full analysis

Vulnerability Details

File Location: commands.md, lines 48–49
Vulnerability Type: Unpinned third-party dependency execution
Risk Level: Medium

Vulnerable Code

bash

npx colorjs.io oklch "0.63 0.18 255" --to srgb
npx colorjs.io srgb "#2563eb" --to oklch

Technical Analysis

The documented commands invoke colorjs.io through npx without specifying an exact, reviewed package version or verifying package integrity. If the package is not already available locally, npx may retrieve it and its transitive dependencies from the configured npm registry before executing its CLI code.

Because dependency resolution occurs at invocation time, the code executed can differ from the code available when this Skill was audited. A compromised package release, maintainer account, transitive dependency, registry, or local registry configuration could therefore turn these conversion commands into arbitrary code execution.

The warning at commands.md:53 correctly identifies the remote-code-execution concern and advises use only in trusted environments, but it does not eliminate the technical risk presented by mutable, unverified dependency resolution.

Attack Path

1. An attacker compromises the colorjs.io package, one of its transitive dependencies, its publisher account, or the package source configured in the victim's npm settings.
2. The attacker publishes or serves a malicious version containing harmful lifecycle or CLI code.
3. A user or agent follows the examples in commands.md and runs an unversioned npx colorjs.io command.
4. npx resolves and downloads the attacker-controlled package version.
5. The malicious package code executes under the invoking user's account.
6. The payload can access resources available to that user and perform additional actions permitted by the local environment and network policy.

Impact Assessment

Successful exploitation permits arbitrary code execution with the privileges of the user runni ...[truncated 559 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the unversioned invocation with an exact, previously reviewed version rather than allowing npm to resolve the latest release dynamically.
2. Prefer installing the dependency in a controlled project with a committed lockfile and verified integrity metadata, then invoke the locked local binary.
3. Review the selected package version and its transitive dependencies before use, including lifecycle scripts and ownership history.
4. Use a trusted npm registry and enforce dependency allowlisting in CI or managed environments.
5. Run conversion tooling with least privilege in a sandbox or disposable container without production credentials, sensitive mounts, or unnecessary network access.
6. Where practical, replace runtime package retrieval with a vetted local implementation or a preinstalled, checksummed tool.
7. Retain and strengthen the existing warning at line 53 by requiring explicit user confirmation before downloading or executing registry-hosted code.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The command uses npx colorjs.io without a pinned version, which can fetch and execute whatever package version is current in the registry at runtime. Because npx executes downloaded package code, this creates a supply-chain and remote-code-execution risk if the package is compromised, replaced, or updated unexpectedly.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

This second npx colorjs.io example has the same issue: it may download and execute unpinned code from the package registry. In a skill file that gives implementation commands, users may copy-paste directly, so the skill context increases the practical likelihood of unsafe execution.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · commands.md (reported line 143)May include surrounding context.

md

- Assuming the same CMYK numbers work equally on every substrate.
- Using deep black builds for small text.
- Forgetting that proof lighting changes color perception.
- Sending a digital-first palette to press without checking out-of-gamut shifts.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · print.md (reported line 52)May include surrounding context.

md

- Assuming the same CMYK numbers work equally on every substrate.
- Using deep black builds for small text.
- Forgetting that proof lighting changes color perception.
- Sending a digital-first palette to press without checking out-of-gamut shifts.

Static analysis

No suspicious patterns detected.