T08 · Insecure Dependencies
Warning
- Location
SKILL.md:24- Finding
Unpinned Executable Dependencies and Mutable Skill Installation
- Content
View full analysis
- Remediation
View remediation
Security audit
Pg Update
Security checks for vulnerabilities and agentic risk
Overview
This skill is an updater, but it can change global packages and installed agent skills with broad, under-scoped instructions.
Install only if you trust ProxyGate and are comfortable with an agent helping modify global npm tooling, project dependencies, and installed Claude Code skills. Before running it, require explicit confirmation for each install or delete command, prefer exact reviewed versions over @latest, review any skill changes before applying them, and treat API keys, wallet keypairs, deposits, withdrawals, and escrow commands as sensitive financial operations.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (7)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The skill description frames this as a straightforward update helper, but the instructions also include side effects not clearly disclosed in the metadata, including proactive triggering behavior and deletion of a local cache file. This mismatch can cause the agent to invoke the skill in broader contexts than the user intended and perform filesystem changes the user did not explicitly authorize.
- Content
Self-Modification
High
- Category
- Rogue Agent
- Confidence
- 93% confidence
- Finding
The
proxygate skills installstep causes the agent tooling to update or install skills, which is a form of self-modification of the agent's future behavior. Self-updating behavior is especially risky because it can silently change prompts, capabilities, or trusted workflows without user review, potentially introducing persistence or new unsafe behavior.- Content
proxygate --version # verify
text ### 4. Update skills New CLI versions may include updated skills:
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
The hard-coded
rm -f ~/.claude/cache/proxygate-update-check.jsondeletes a file in the user's home directory without confirmation or validation. Even though the target is specific, silent deletion is dangerous in an agent context because it normalizes destructive shell usage and can remove user or tool state unexpectedly.- Content
5. Clear update cache
bash rm -f ~/.claude/cache/proxygate-update-check.jsonSDK Update
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger text is overly broad because it directs proactive activation whenever an update notification appears or when a session starts with such a notification, rather than only on explicit user intent. Broad triggers increase the chance that package installation and other side effects occur automatically in contexts where the user did not ask for system changes.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill includes commands that modify the global environment and project dependencies, such as global npm installation, package updates, skill installation, and file deletion, but provides no confirmation or safety checks. In an agent setting, this can lead to unreviewed supply-chain changes, breaking user environments, or destructive actions being taken automatically.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The reference explicitly documents authentication with API keys and wallet keypairs, including generating a new wallet keypair, but provides no warning that these are sensitive credentials requiring secure storage and careful handling. In an agent skill context, this increases the chance an automated assistant may prompt for, expose, or mishandle secret material such as keypair files or live API keys.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The documentation lists real fund-moving operations such as deposit, withdraw, withdraw-confirm, and later escrow release/refund actions without clearly warning that they affect actual assets and may be irreversible or costly if misused. In a skill meant to guide updates or CLI use, an agent could surface or suggest these commands without sufficient friction, leading users to execute financially impactful actions unintentionally.
- Content
Static analysis
No suspicious patterns detected.