dropspace-content-engine

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:12 AM UTC
• Version: 1.0.1

Overview

This skill is coherent for an autonomous social-content engine, but it asks users to run unreviewed external code with live account credentials and can schedule public posts without clear guardrails.

Review before installing. Use a dedicated project directory, inspect the cloned repository and lockfile before running npm install, prefer npm ci with reviewed dependencies, avoid source .env, and use narrowly scoped, revocable API keys. Do not connect live social accounts or enable nightly scheduling until you have confirmed the generated content, cleanup behavior, and posting permissions match what you intend.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:29

Finding

Unpinned Remote Code and Dependency Retrieval

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 29-31
Vulnerability Type: Remote payload retrieval and insecure dependency installation
Risk Level: High

bash

git clone https://github.com/joshchoi4881/dropspace-agents && cd dropspace-agents && npm install

Technical Analysis

The installation procedure retrieves executable content from an external Git repository without pinning it to a reviewed commit hash or release artifact. Consequently, the code installed by a user can differ from the code present when the Skill was reviewed.

The subsequent npm install operation installs third-party packages and may execute npm lifecycle scripts, including preinstall, install, and postinstall. The audited artifact does not include the cloned repository, its package manifest, its lockfile, or its scripts. Their behavior and integrity therefore cannot be verified from this project.

This combines two supply-chain risks:

1. The effective application payload can change after review because the repository revision is not pinned.
2. npm dependencies or lifecycle scripts can execute code during installation without an explicit integrity-verification step.

Attack Path

1. An attacker compromises the upstream repository, its default branch, a maintainer account, or one of its npm dependencies.
2. The attacker adds malicious application code or a malicious npm lifecycle script.
3. A user follows the documented command and clones the current default branch.
4. npm install installs the compromised dependency tree or executes the malicious lifecycle script.
5. The payload runs with the operating-system privileges of the user performing the installation.
6. The payload may inspect local files and environment variables, including the API keys that the Skill instructs the user to configure, and may transmit accessible data over the network.

Impact Assessment

Successful exploitat ...[truncated 622 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the upstream repository to a specific, reviewed commit hash rather than cloning and executing the mutable default branch.
• Publish and verify a cryptographic checksum or signed release artifact.
• Include a reviewed npm lockfile and use npm ci instead of npm install to enforce the locked dependency graph.
• Review all npm lifecycle scripts and use npm ci --ignore-scripts when lifecycle execution is unnecessary.
• Enable dependency integrity, provenance, and signature verification where supported.
• Run installation and application scripts in a restricted container or dedicated low-privilege account with minimal filesystem and network access.
• Provide API credentials only after installation has completed and the installed source has been verified.
• Use narrowly scoped, revocable API keys and prevent installation processes from inheriting unrelated credentials.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:59

Finding

Arbitrary Shell Execution Through Sourced Environment File

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 59-62
Vulnerability Type: Unsafe execution of configuration as shell code
Risk Level: Medium

bash

source .env

# Analyze performance + generate new posts
node scripts/run-self-improve-all.js --app myapp

Technical Analysis

The command source .env instructs the current shell to parse and execute the entire .env file as shell code. A shell does not restrict sourced content to simple KEY=value declarations. The file can contain command substitutions, function definitions, redirections, external commands, or other arbitrary shell syntax.

The setup instructions state that .env may be copied from a template in the externally cloned repository. If that template or the resulting local file is maliciously modified, sourcing it creates a direct arbitrary-command execution path. The commands execute in the current shell and inherit its environment and permissions.

Attack Path

1. An attacker compromises the upstream .env template, modifies the local .env through another compromised process, or persuades the user to use a crafted file.
2. The attacker inserts shell syntax into the file, such as command substitution or an external command disguised alongside environment assignments.
3. The user follows the documented pipeline instructions and runs source .env.
4. The current shell immediately executes the injected commands.
5. The injected code can access exported secrets, user-readable files, and network resources available to the invoking account.
6. Execution then continues to the documented Node.js command, potentially leaving the compromise unnoticed.

Impact Assessment

Exploitation permits arbitrary command execution with the privileges of the user running the pipeline. It may expose the three configured API credentials, modify project or user-owned files, alter generated content, or misuse external services within the cred ...[truncated 246 chars]

Remediation

View remediation

Remediation Suggestions

• Do not load dotenv files with source, ., eval, or equivalent shell-evaluation mechanisms.
• Load the file through a strict dotenv parser in the Node.js application.
• Permit only explicitly approved variable names and reject command substitutions, shell metacharacters, function declarations, and malformed lines.
• Provide a trusted launcher that reads key-value data without evaluating it as code.
• Verify the provenance and integrity of any example or generated environment file before use.
• Restrict .env permissions to the owning user, keep it outside version control, and ensure it cannot be modified by untrusted users or processes.
• Use narrowly scoped and revocable credentials, and rotate them immediately if an environment file may have been compromised.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 60)May include surrounding context.

Run the Pipeline

bash

source .env

# Analyze performance + generate new posts
node scripts/run-self-improve-all.js --app myapp

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The description says to use the skill when asked to 'set up autonomous content posting, run the content engine, or manage multi-platform social media automation,' which is broad enough to trigger on loosely related requests. Because the skill performs high-impact external actions like generating and scheduling posts, over-broad invocation increases the chance of unintended activation and accidental actions on connected social accounts.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill documents autonomous posting, nightly scheduling, analytics refresh, and cleanup of old media, but it does not prominently warn that these operations affect real external accounts and stored assets. In this context, missing warnings are dangerous because users or upstream agents may invoke the pipeline without understanding it can publish content and delete media automatically across multiple platforms.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.