Pickfu Market Research

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:38 AM UTC
• Version: 1.0.1

Overview

The skill is purpose-aligned for PickFu research, but it repeatedly runs an unpinned latest-version CLI with account credentials and billable survey authority.

Review carefully before installing. Prefer MCP or a pinned, preinstalled PickFu CLI version, use a tightly scoped PickFu API key, avoid uploading confidential or regulated material unless authorized, and confirm all billable actions before the agent publishes or adds respondents.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:37

Finding

Unpinned CLI Dependency Is Automatically Downloaded and Executed

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 37-51
Vulnerability Type: Supply-chain exposure through a mutable third-party dependency
Risk Level: Medium

Complete Code Snippet:

bash

npx --yes @pickfu/cli@latest auth status --json

bash

npx --yes @pickfu/cli@latest auth login --headless

bash

npx --yes @pickfu/cli@latest schema

The package is also declared without an exact version in SKILL.md, line 9:

yaml

metadata: {"openclaw":{"requires":{"bins":[],"env":["PICKFU_API_KEY"]},"primaryEnv":"PICKFU_API_KEY","emoji":"📊","homepage":"https://www.pickfu.com","os":["darwin","linux","win32"],"install":[{"kind":"node","package":"@pickfu/cli","bins":["pickfu"]}]}}

Technical Analysis

The documented commands instruct the agent to download and execute the mutable latest release of @pickfu/cli, automatically accepting installation with --yes. No exact version, lockfile, package digest, or integrity verification constrains which code will run.

Consequently, the effective executable can change after this skill has been audited. This is not evidence that the current package is malicious, but it creates a supply-chain trust boundary: compromise of the package publisher, registry account, or a future release could introduce arbitrary code into normal skill execution. The unversioned installation metadata reinforces the same issue.

Attack Path

1. An attacker compromises the upstream package, its publisher account, or its release process.
2. The attacker publishes a malicious release as the package's latest version.
3. The agent follows the skill instructions and runs an npx --yes @pickfu/cli@latest ... command.
4. npx downloads and executes the changed package locally without an interactive installation confirmation.
5. The malicious package executes with the privileges and environment of the agent process.

Impact Assessment

Successful e ...[truncated 452 chars]

Remediation

View remediation

Remediation Suggestions

• Pin @pickfu/cli to a specific audited version in every command and in the installation metadata.
• Remove the @latest tag and update versions only through a reviewed dependency-update process.
• Use a lockfile and package-manager integrity metadata where the host supports them.
• Verify package provenance, signatures, or registry integrity data before execution.
• Prefer a preinstalled, approved CLI binary rather than downloading executable code during each invocation.
• Run the CLI in a restricted environment with minimal filesystem access, a tightly scoped API credential, and controlled outbound network access.
• Rotate PICKFU_API_KEY promptly if dependency compromise is suspected.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:155

Finding

Predictable Shared Temporary File Enables Symlink and Race Attacks

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 155-174
Vulnerability Type: Unsafe temporary-file handling
Risk Level: Medium

Complete Code Snippet:

bash

cat > /tmp/survey.json << 'EOF'
{
  "surveyIntent": "Which logo do pet owners prefer?",
  "sampleSize": "50",
  "country": "US",
  "targeting": ["amznpr"],
  "reporting": ["gender", "age-range"],
  "questions": [{
    "type": "head_to_head",
    "prompt": "Which logo do you prefer for a pet food brand?",
    "options": [
      { "mediaUrl": "https://cdn.example.com/logo-a.jpg" },
      { "mediaUrl": "https://cdn.example.com/logo-b.jpg" }
    ]
  }]
}
EOF
npx --yes @pickfu/cli@latest survey create --from-file /tmp/survey.json --json

Technical Analysis

The workflow writes survey data to the fixed path /tmp/survey.json. Shared temporary directories are commonly writable by multiple local users. The snippet does not create the file exclusively, verify that it is a regular file, set restrictive permissions, or protect the interval between writing and reading.

A local attacker may pre-create /tmp/survey.json as a symbolic link to another file writable by the agent, causing shell redirection to overwrite that target. Alternatively, an attacker can replace or modify the temporary file after the here-document completes but before the CLI reads it, resulting in a time-of-check/time-of-use race. The file may also expose potentially sensitive research content if default permissions make it readable to other local users.

Attack Path

Symlink attack:

1. A local attacker predicts that the skill will use /tmp/survey.json.
2. Before execution, the attacker creates /tmp/survey.json as a symbolic link to a file writable by the agent.
3. The shell processes cat > /tmp/survey.json and follows the symbolic link.
4. The linked target is truncated and overwritten with survey JSON.

**Survey-manipulation rac ...[truncated 956 chars]

Remediation

View remediation

Remediation Suggestions

• Create a unique file securely with mktemp rather than using a predictable name.
• Set a restrictive process umask and file mode so only the current user can read the payload.
• Register a cleanup trap and remove the temporary file after use.
• Keep the generated path in a quoted variable.
• Where supported, avoid a temporary file entirely and provide the payload through standard input.

Example hardened workflow:

bash

umask 077
survey_file="$(mktemp "${TMPDIR:-/tmp}/pickfu-survey.XXXXXX.json")" || exit 1
trap 'rm -f -- "$survey_file"' EXIT HUP INT TERM

cat > "$survey_file" <<'EOF'
{
  "surveyIntent": "Which logo do pet owners prefer?",
  "sampleSize": "50",
  "country": "US",
  "targeting": ["amznpr"],
  "reporting": ["gender", "age-range"],
  "questions": [{
    "type": "head_to_head",
    "prompt": "Which logo do you prefer for a pet food brand?",
    "options": [
      { "mediaUrl": "https://cdn.example.com/logo-a.jpg" },
      { "mediaUrl": "https://cdn.example.com/logo-b.jpg" }
    ]
  }]
}
EOF

npx --yes @pickfu/cli@<PINNED_VERSION> survey create \
  --from-file "$survey_file" --json

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (18)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill encourages uploading files/URLs to PickFu's CDN and collecting verbatim respondent quotes plus demographic breakdowns, but provides no explicit privacy warning or data-classification guidance. Users may unknowingly send sensitive business assets, personal data, or regulated content to a third-party service and then process demographic response data without informed consent or minimization.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The skill repeatedly instructs the agent to execute npx --yes @pickfu/cli@latest, which fetches and runs whatever code is current in the npm registry at execution time. This creates a supply-chain risk: a compromised publisher account, malicious dependency update, or typosquatted replacement could lead to arbitrary code execution in the agent environment, potentially exposing secrets such as PICKFU_API_KEY or local files.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

This invocation also uses @latest, causing runtime download and execution of unpinned third-party code. In an agent context, that means the trust boundary extends to the entire npm publication pipeline at the moment of use, enabling remote code execution if the package or its dependencies are compromised.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The schema discovery step instructs execution of an unpinned package from npm, again introducing arbitrary code execution risk. Because this step is recommended once per session, it may be one of the first commands run, before the user has any visibility into package integrity.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The image-generation and media-upload workflow omits a clear warning that prompts, reference images, and uploaded assets are transmitted to PickFu services, which can expose proprietary designs, internal product concepts, or personal imagery. In market-research contexts, reference images often contain confidential branding or unreleased packaging, so silent third-party transfer materially increases confidentiality risk.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The media generation command uses a dynamic npx install of the latest CLI version, so a compromised npm release could execute attacker-controlled code while processing prompts and credentials. Since this step may involve proprietary creative prompts and authenticated API access, the blast radius includes both code execution and data exposure.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

Listing targeting or reporting options through an unpinned npx invocation exposes the host to the same supply-chain risk as other examples. Even read-oriented commands are dangerous because the code must still be installed and executed locally before contacting the service.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

Survey creation is performed through a latest-version npx command, allowing arbitrary newly published code to run in a context that likely has access to API keys and survey payload data. If exploited, an attacker could exfiltrate credentials, alter surveys, or tamper with billing-affecting operations.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

Publishing a survey via an unpinned package magnifies risk because it combines arbitrary code execution with a state-changing, billable action. A malicious package version could silently publish unwanted surveys, modify IDs, or misuse the authenticated account.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The polling loop continuously invokes the latest package version from npm, multiplying exposure by repeating trust in remote package resolution over time. This increases the window for compromise and could repeatedly run attacker-controlled code in a long-lived agent session.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

Updating surveys through an unpinned npm package remains a genuine supply-chain issue because the package executes with the user's authenticated context and can change stored survey state. The impact is somewhat lower than raw secret theft only if the environment is tightly sandboxed, but it still enables account misuse and data tampering.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

Project creation via unpinned npx has the same package-supply-chain risk, with the added ability to manipulate organizational data in the PickFu account. In a broader agent environment, the executed code may also access environment variables and local filesystem content.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

This second update command again executes unpinned third-party code from npm, creating a real remote code execution and account-manipulation path. Although the immediate operation is narrow, the local execution privileges of the package make the risk broader than the API action shown.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

Adding respondents is a billable action, so running it through an unpinned package creates both supply-chain and financial-abuse risk. A compromised version could trigger unauthorized charges, alter counts, or exfiltrate credentials while appearing to perform a normal preview/commit flow.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

Even a survey listing command still requires executing the latest published package code locally, so it is a true supply-chain vulnerability rather than a harmless documentation issue. The skill context is more dangerous because the environment is expected to hold API credentials and potentially sensitive research history.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.