Security audit

Joycode

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent JoyCode CLI helper, but it asks users to install and run a broad shell-based coding agent with full-auto file editing and approval-policy controls without enough scoping or safeguards.

Install only if you intentionally want JoyCode CLI to operate as a coding agent in your shell. Pin and verify the npm package where possible, avoid running it as root, use it in a version-controlled or sandboxed project, review diffs before accepting changes, and be cautious with full-auto mode and approval-policy changes.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:12
Finding: Unpinned Global Installation of a Third-Party npm Package## Vulnerability Details **File Location**: `SKILL.md`, lines 12-16 **Vulnerability Type**: Unpinned third-party dependency installed globally **Risk Level**: Medium ```bash # 使用 npm 全局安装 npm install -g joycode-cli # 验证安装 joycode-cli --version ``` ### Technical Analysis The Skill instructs users or agents to globally install `joycode-cli` without specifying an exact version, integrity hash, lockfile, trusted registry URL, or verified publisher. The effective installed artifact can therefore change over time without any corresponding change to the reviewed Skill. npm packages may execute lifecycle scripts during installation. Because the package is installed globally, a compromised package release, compromised maintainer account, package ownership transfer, or malicious transitive dependency could execute code with the privileges of the user running npm and place files in globally accessible package or binary locations. The package implementation is not included in this project, so its installation behavior cannot be verified by this audit. ### Attack Path 1. An attacker compromises the `joycode-cli` npm package, its publisher account, or one of its install-time dependencies. 2. The attacker publishes a malicious release or alters a mutable dependency resolved by the package. 3. A user or agent follows the documented `npm install -g joycode-cli` command. 4. npm retrieves the current package release rather than a previously audited, fixed artifact. 5. Malicious lifecycle code executes during installation, or an attacker-controlled global CLI binary is installed. 6. Subsequent `joycode-cli` commands execute the compromised implementation. ### Impact Assessment Exploitation could provide arbitrary code execution with the permissions of the user invoking npm. Potential scope includes access to that user's files, source repositories, environment variables, npm configuration, and other credentials available to the proc ...[truncated 295 chars]
Remediation: ## Remediation Suggestions - Pin `joycode-cli` to an exact, reviewed version rather than installing the latest mutable release. - Document and verify the official npm package name, publisher identity, provenance, and expected registry URL. - Record and verify the package integrity digest before installation. - Prefer a project-local, lockfile-controlled installation over a global installation. - Review the package and its transitive dependencies, including npm lifecycle scripts, before use. - Disable lifecycle scripts with `--ignore-scripts` where compatible with the package. - Execute the CLI in a sandbox or container with restricted filesystem, network, credential, and repository access. - Avoid running npm or the CLI as root or another privileged account. - Establish an update-review process so newer releases are not consumed automatically.

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The skill advertises activation for very broad programming tasks such as code generation, code review, interactive programming, and automated code tasks. This can cause the skill to trigger in many common developer conversations and route users into a shell-backed CLI workflow with stronger side effects than expected, increasing the chance of unintended command execution or file modification.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The documentation explicitly promotes a full-auto mode that allows file editing, but it does not prominently warn that project files may be modified automatically. In the context of a shell-controlled coding assistant, this raises the risk that users invoke destructive or large-scale repository changes without informed consent or adequate review controls.

Natural-Language Policy Violations

Low

Confidence: 84% confidence
Finding: The natural-language instructions and examples are presented only in Chinese, which can amount to a language-policy issue if users are not given a choice of language or told that the skill is intentionally region-specific. There is no indication that this locale restriction is required or that alternative language support is available.

Static analysis

No suspicious patterns detected.