Harrypotter

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:45 AM UTC
• Version: 1.0.0

Overview

The skill's stated Harry Potter lookup purpose is coherent, but installation depends on unreviewed executable scripts fetched from a mutable GitHub repository.

Review this skill before installing. Its intended function is low-risk, but you would be trusting scripts from the current state of an external GitHub repository rather than code included in this reviewed package. Prefer a version pinned to a reviewed commit or release with checksums, and run it with only the filesystem and network access needed for HP-API lookups.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: README.md:7

Finding

Unpinned Retrieval of Executable Scripts from a Mutable Repository

Content

View full analysis

Vulnerability Details

File Location: README.md, lines 7-9
Vulnerability Type: Supply-chain risk from an unpinned executable dependency
Risk Level: Medium

Vulnerable Code:

bash

git clone https://github.com/jeffaf/harrypotter-skill.git
cd harrypotter-skill
chmod +x harrypotter scripts/harrypotter

Technical Analysis

The documented installation procedure clones the current contents of a mutable GitHub repository and marks two downloaded scripts as executable. It does not pin the repository to a reviewed commit, release tag with verified provenance, or immutable artifact checksum.

The audited artifact contains only README.md and SKILL.md; it does not contain the referenced harrypotter or scripts/harrypotter files. Consequently, the executable behavior users are instructed to install and invoke cannot be verified from the reviewed package. If the upstream repository, its maintainer account, or its default branch were compromised or maliciously modified, subsequent installations could retrieve substituted scripts.

This is a supply-chain weakness rather than evidence that the current upstream repository is malicious.

Attack Path

1. An attacker compromises the upstream repository, a maintainer account, or another mechanism capable of modifying its default branch.
2. The attacker replaces either harrypotter or scripts/harrypotter with malicious code.
3. A user follows the documented installation instructions and clones the mutable repository without commit pinning or integrity verification.
4. The user marks the downloaded scripts as executable with chmod +x.
5. The agent invokes those scripts according to the usage instructions in SKILL.md.
6. The substituted code executes with the operating-system privileges and environment access of the user running the agent.

Impact Assessment

Successful exploitation could provide arbitrary code execution under the invoking use ...[truncated 492 chars]

Remediation

View remediation

Remediation Suggestions

1. Include the referenced executable scripts in the skill artifact so their exact contents are available for review.
2. Pin installations to a specific reviewed commit hash instead of implicitly using the repository's mutable default branch.
3. Publish versioned, immutable release artifacts and provide SHA-256 or stronger cryptographic checksums.
4. Verify artifact signatures or attestations before granting execute permission or running the scripts.
5. Document the expected checksum and fail installation if verification does not succeed.
6. Run the skill with least privilege in a restricted environment, exposing only the files, environment variables, and network destinations required for its stated API lookup function.
7. Add the complete executable source to future audit submissions so network requests, argument handling, shell quoting, and jq usage can be assessed directly.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The instruction 'When user asks about Harry Potter' is a broad natural-language trigger that could overlap with many casual mentions or conversational references to Harry Potter. The file provides some command guidance and a 'Don't use for' note, but it does not clearly define narrower trigger phrases or negative examples for borderline cases.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.