Pokemon

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:46 AM UTC
• Version: 1.0.0

Overview

The skill appears to be a simple Pokémon lookup helper, but its install instructions fetch and execute unreviewed code from a mutable external GitHub repository.

Install only if you trust the external GitHub repository and are willing to run its scripts locally. Safer installation would require the full executable implementation in the reviewed package, or a pinned commit plus checksum or signature verification before chmod and use.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: README.md:8
• Finding: Unpinned External Repository Used as an Executable Dependency<![CDATA[ ## Vulnerability Details **File Location**: `README.md`, lines 8–13 **Vulnerability Type**: Unverified mutable executable dependency **Risk Level**: Medium ### Vulnerable Code ```bash # Clone to your skills folder git clone https://github.com/jeffaf/pokemon-skill.git ~/clawd/skills/pokemon # Make executable chmod +x ~/clawd/skills/pokemon/pokemon chmod +x ~/clawd/skills/pokemon/scripts/pokemon ``` ### Technical Analysis The installation instructions clone the mutable default branch of an external GitHub repository without pinning a reviewed commit, verifying a cryptographic checksum, or validating a signature. The downloaded `pokemon` wrapper and `scripts/pokemon` file are then granted executable permissions. Neither executable is present in the audited artifact, which contains only `README.md` and `SKILL.md`. Consequently, the artifact cannot substantiate the claim that the skill only queries PokéAPI, and the behavior of the externally obtained executables remains outside the reviewed security boundary. This creates a supply-chain trust issue: a compromise of the upstream repository, its maintainer account, or its default branch could alter the code users receive after this artifact has been reviewed. ### Attack Path 1. An attacker compromises the upstream repository or an account authorized to modify its default branch. 2. The attacker adds malicious behavior to `pokemon`, `scripts/pokemon`, or another component loaded by those files. 3. A user follows `README.md` and clones the mutable repository without selecting a known-safe commit. 4. The user marks the downloaded scripts as executable. 5. The agent invokes `pokemon` according to the usage instructions in `SKILL.md`. 6. The modified script executes with the privileges of the user account running the agent. ### Impact Assessment Successful exploitation could execute arbitrary commands with the agent user's permissions. The resulting scope may include reading or modifying files accessib ...[truncated 437 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Include the complete `pokemon` wrapper and `scripts/pokemon` implementation directly in the reviewed skill package. 2. If external retrieval is unavoidable, pin the repository to a specific reviewed commit hash rather than cloning the mutable default branch. 3. Publish and verify a SHA-256 or stronger checksum for every executable before granting execution permission. 4. Prefer signed release artifacts or signed Git tags and document signature verification steps. 5. Fail installation if commit, checksum, or signature verification does not succeed. 6. Audit all downloaded scripts and any files they source or execute before deployment. 7. Run the skill with least privilege and restrict access to credentials, sensitive files, and unnecessary environment variables. 8. Ensure future security reviews cover the exact executable files distributed to users, not only their documentation. ]]>

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: The usage section includes broad natural-language triggers like "Look up Pikachu" and "Tell me about the ability Levitate," which can overlap with ordinary user conversation rather than serving as narrowly scoped invocation patterns. In agent environments that auto-dispatch skills based on prompt matching, this can cause unintended invocation of the Pokémon skill when the user is simply chatting, increasing the risk of incorrect tool use or context hijacking, though the skill itself is low-risk because it only performs read-only PokéAPI lookups.

Static analysis

No suspicious patterns detected.