Fix NPM Vulnerabilities

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:24 AM UTC
• Version: 1.0.1

Overview

The skill is mostly a disclosed npm vulnerability workflow, but it lets the agent silently install unpinned global tools without user approval.

Review this skill before installing. The npm vulnerability workflow is understandable, but require the agent to ask before installing any missing tool, show the exact package and command, and prefer project-local or pinned tooling over global installs.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:46

Finding

Silent Global Installation of Insufficiently Verified Third-Party Tools

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 46-59
Vulnerability Type: Supply-chain risk through unpinned and insufficiently verified tool installation
Risk Level: Medium

Vulnerable Code

markdown

## Tool Auto-Installation

If a tool required to complete any step is not installed on the current machine, apply the following policy before asking the user:

1. **Check availability** — verify whether the tool is missing (e.g. `where tool` or `which tool` returns nothing)
2. **Assess risk** — a tool is considered low-risk if it is:
   - Publicly available (official npm package, well-known CLI, OS package manager)
   - Widely used and maintained (e.g. `npm-check-updates`, `snyk`, `yarn`, `pnpm`)
   - Non-destructive by default (does not modify system files, does not require elevated permissions)
3. **Auto-install if low-risk** — install silently without asking the user:
   - npm global tool: `npm install -g <tool>`
   - winget (Windows): `winget install <tool>`
   - Other package managers as appropriate for the OS
4. **Ask the user if high-risk** — if the tool requires admin rights, modifies system config, or is from an unverified source, show the install command and ask for confirmation before proceeding.

Technical Analysis

The skill instructs the agent to install tools silently and globally when they are subjectively classified as “low-risk.” Its validation criteria do not require an exact canonical package identity, trusted repository, pinned version, integrity digest, publisher signature, or independent verification of the package source.

The unrestricted <tool> placeholder and authorization to use “other package managers” make the set of installable components open-ended. Public availability and apparent popularity are not sufficient supply-chain controls: a package may be typosquatted, dependency-confused, renamed, transferred to a malicious maintainer, or compromised after becoming established.

F ...[truncated 2026 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove silent auto-installation and require explicit user approval before installing any missing tool.
2. Display the exact package name, publisher, registry or repository, version, installation scope, and full command before requesting approval.
3. Maintain a restrictive allowlist mapping supported tools to canonical package identifiers and trusted sources.
4. Pin each dependency to a reviewed version rather than resolving an unconstrained latest release.
5. Verify package signatures, checksums, provenance attestations, or registry integrity metadata where supported.
6. Prefer project-local or isolated ephemeral installation over global installation so the tool cannot unexpectedly affect unrelated projects or future sessions.
7. Review transitive dependencies and package lifecycle scripts before installation. Disable lifecycle scripts where feasible and only enable them after review when required.
8. Do not infer package identity directly from a missing executable name, because executable and package names may differ and can be spoofed.
9. Require separate confirmation for elevated installation, system-wide modification, unverified publishers, custom registries, and operating-system package managers.
10. Record the selected package, source, version, integrity information, approval, and installation result in the workflow report.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill explicitly authorizes silent installation of tools without prior user warning or confirmation. Even if framed as "low-risk," global package installation changes the host environment, may pull unreviewed code from registries or package managers, and can expand the attack surface or violate user expectations in a security-sensitive workflow.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 54)May include surrounding context.

md

2. **Assess risk** — a tool is considered low-risk if it is:
   - Publicly available (official npm package, well-known CLI, OS package manager)
   - Widely used and maintained (e.g. `npm-check-updates`, `snyk`, `yarn`, `pnpm`)
   - Non-destructive by default (does not modify system files, does not require elevated permissions)
3. **Auto-install if low-risk** — install silently without asking the user:
   - npm global tool: `npm install -g <tool>`
   - winget (Windows): `winget install <tool>`

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 95% confidence

Finding

The phrase "install silently without asking the user" delegates security-relevant decisions to the agent and permits autonomous modification of the system. In this context, the skill is for remediation, but autonomy over package installation is still dangerous because trust decisions about external software are being made without human approval.

Content

Scanner excerpt · SKILL.md (reported line 55)May include surrounding context.

md

- Publicly available (official npm package, well-known CLI, OS package manager)
   - Widely used and maintained (e.g. `npm-check-updates`, `snyk`, `yarn`, `pnpm`)
   - Non-destructive by default (does not modify system files, does not require elevated permissions)
3. **Auto-install if low-risk** — install silently without asking the user:
   - npm global tool: `npm install -g <tool>`
   - winget (Windows): `winget install <tool>`
   - Other package managers as appropriate for the OS

Static analysis

No suspicious patterns detected.