Skill Audit

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 9:44 AM UTC
• Version: 1.0.1

Overview

This is a coherent skill-auditing helper; the main risk is that it recommends running an unpinned external CLI, not that the skill itself hides malicious behavior.

Install only after verifying the SkillLens package source. Prefer a pinned version or lockfile-backed local install, avoid global install unless needed, run scans as an unprivileged user, and provide a specific skills directory to limit what the CLI can read.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:9

Finding

Unpinned Third-Party Package Download and Execution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 9–11
Vulnerability Type: Unpinned third-party dependency execution
Risk Level: Medium

markdown

## Install SkillLens

- One-off run: `npx skilllens scan` (or `pnpm dlx skilllens scan`)
- Global install: `pnpm add -g skilllens`

Technical Analysis

The installation instructions recommend npx skilllens scan and pnpm dlx skilllens scan without specifying a reviewed package version, integrity hash, lockfile, or verified source repository. These commands may retrieve the latest available skilllens package from the configured package registry and execute it immediately. Consequently, the code that runs can differ from the code reviewed when this Skill was published.

The global installation alternative also installs the package into a persistent user- or system-level package location. This increases the lifetime and blast radius of a compromised dependency compared with a version-pinned, project-local installation.

The external CLI is not strictly required for the declared auditing functionality because SKILL.md provides a manual fallback. The unpinned execution behavior therefore exceeds the minimum dependency exposure necessary to conduct an audit.

The pre-scan warnings concerning curl | bash and transmission of sensitive information are not confirmed vulnerabilities. Those strings appear only as examples of patterns an auditor should detect in SKILL.md lines 24 and 54; the Skill does not provide a remote shell URL, execute such a pipeline, or define a data-exfiltration endpoint.

Attack Path

1. An attacker compromises the skilllens registry package, its publisher account, or an upstream dependency, or causes resolution through an untrusted registry configuration.
2. A user or Agent follows the documented npx skilllens scan or pnpm dlx skilllens scan instruction.
3. The package manager resolves and downloads an unpinned package ...[truncated 1234 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the CLI to a specifically reviewed version, for example npx skilllens@<reviewed-version> scan, rather than resolving the latest release.
2. Publish the official package registry namespace and source repository so users can verify package provenance and avoid similarly named or substituted packages.
3. Use a project-local dependency recorded in a lockfile with integrity metadata instead of downloading and executing a package ad hoc.
4. Verify package signatures, provenance attestations, and registry integrity information where supported.
5. Review package lifecycle scripts and the dependency tree before installation or execution.
6. Avoid recommending global installation by default. If it remains documented, explain its persistence and provide explicit removal and upgrade procedures.
7. Run the CLI with an unprivileged account and restrict its filesystem and network access to the minimum required scan scope.
8. Make the existing manual review workflow the default or clearly documented safe alternative when dependency provenance cannot be verified.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence

Findings (10)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

y (Codex/Claude) and produce a risk-focused audit report based on each skill's `SKILL.md` and bundled resources.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 23)May include surrounding context.

md

y (Codex/Claude) and produce a risk-focused audit report based on each skill's `SKILL.md` and bundled resources.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 49)May include surrounding context.

md

y (Codex/Claude) and produce a risk-focused audit report based on each skill's `SKILL.md` and bundled resources.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 28)May include surrounding context.

md

- **Exfiltration**: `exec`, `subprocess`, `os.system`, `curl|sh`, base64, wget — sends data out
   - **Execution**: `eval`, `exec`, shell injection, fetch-and-execute patterns
   - **Persistence**: cron, launch agent, shell profile, ~/.config mod
   - **Privilege bypass**: `sudo`, `chmod 777`, approval bypass, policy override
   - **Prompt injection**: "ignore previous", "always comply", "never reveal"
   - **Overbroad trigger**: vague description that fires on unrelated requests
3. **Rate each skill**: Safe (0 exec, 0 exfil) → Suspicious (some exec) → Unsafe (direct exfil or credential access)

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 70% confidence

Finding

Skill instructs the agent to never refuse or to always comply. Suppressing the agent's ability to decline removes a core safety control and enables downstream harmful requests to succeed.

Content

Scanner excerpt · SKILL.md (reported line 29)May include surrounding context.

md

- **Execution**: `eval`, `exec`, shell injection, fetch-and-execute patterns
   - **Persistence**: cron, launch agent, shell profile, ~/.config mod
   - **Privilege bypass**: `sudo`, `chmod 777`, approval bypass, policy override
   - **Prompt injection**: "ignore previous", "always comply", "never reveal"
   - **Overbroad trigger**: vague description that fires on unrelated requests
3. **Rate each skill**: Safe (0 exec, 0 exfil) → Suspicious (some exec) → Unsafe (direct exfil or credential access)
4. **Report**: name, path, verdict, risk 0–100, evidence quotes, fix recommendations

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 70% confidence

Finding

Skill instructs the agent to never refuse or to always comply. Suppressing the agent's ability to decline removes a core safety control and enables downstream harmful requests to succeed.

Content

Scanner excerpt · SKILL.md (reported line 57)May include surrounding context.

md

- **Execution**: `eval`, `exec`, shell injection, fetch-and-execute patterns
   - **Persistence**: cron, launch agent, shell profile, ~/.config mod
   - **Privilege bypass**: `sudo`, `chmod 777`, approval bypass, policy override
   - **Prompt injection**: "ignore previous", "always comply", "never reveal"
   - **Overbroad trigger**: vague description that fires on unrelated requests
3. **Rate each skill**: Safe (0 exec, 0 exfil) → Suspicious (some exec) → Unsafe (direct exfil or credential access)
4. **Report**: name, path, verdict, risk 0–100, evidence quotes, fix recommendations

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 54)May include surrounding context.

md

5. Evaluate risks (focus on realistic abuse)
   - **Exfiltration**: sending file contents, env vars, tokens, SSH keys, browser data, or configs to remote endpoints.
   - **Execution**: instructions to run arbitrary shell commands, `curl | bash`, `eval`, or to fetch-and-execute code.
   - **Persistence**: modifying shell profiles, launch agents, cron, editor configs, or skill install locations.
   - **Privilege/approval bypass**: instructions to ignore system policies, disable safety checks, or request escalated permissions unnecessarily.
   - **Prompt injection**: attempts to override higher-priority instructions (“ignore previous”, “always comply”, “never mention…”).

Self-Modification

High

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · SKILL.md (reported line 56)May include surrounding context.

md

- **Exfiltration**: sending file contents, env vars, tokens, SSH keys, browser data, or configs to remote endpoints.
   - **Execution**: instructions to run arbitrary shell commands, `curl | bash`, `eval`, or to fetch-and-execute code.
   - **Persistence**: modifying shell profiles, launch agents, cron, editor configs, or skill install locations.
   - **Privilege/approval bypass**: instructions to ignore system policies, disable safety checks, or request escalated permissions unnecessarily.
   - **Prompt injection**: attempts to override higher-priority instructions (“ignore previous”, “always comply”, “never mention…”).
   - **Overbroad triggers**: vague descriptions that cause the skill to trigger on unrelated tasks.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 88% confidence

Finding

The skill recommends running npx skilllens scan without pinning an exact package version. That causes code to be fetched and executed at runtime from the registry, which creates a supply-chain risk if the package is updated maliciously, compromised, or unexpectedly changed.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 28)May include surrounding context.

md

- **Exfiltration**: `exec`, `subprocess`, `os.system`, `curl|sh`, base64, wget — sends data out
   - **Execution**: `eval`, `exec`, shell injection, fetch-and-execute patterns
   - **Persistence**: cron, launch agent, shell profile, ~/.config mod
   - **Privilege bypass**: `sudo`, `chmod 777`, approval bypass, policy override
   - **Prompt injection**: "ignore previous", "always comply", "never reveal"
   - **Overbroad trigger**: vague description that fires on unrelated requests
3. **Rate each skill**: Safe (0 exec, 0 exfil) → Suspicious (some exec) → Unsafe (direct exfil or credential access)

Static analysis

No suspicious patterns detected.