Dietu CLI Agent

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 5:33 AM UTC
• Version: 1.0.1

Overview

This skill is a straightforward guide for using the Dietu CLI, with disclosed authentication and account-data access, but users should install and handle credentials carefully.

Before installing, prefer a reviewed pinned Dietu CLI version if available, avoid putting real passwords directly on the command line, use least-privileged and revocable PATs for automation, and run logout or rotate tokens if the machine is shared or compromised.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:26

Finding

Unpinned Global Installation of a Mutable npm Package

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:26
Vulnerability Type: Unpinned third-party dependency installed globally
Risk Level: Medium

Vulnerable Code

markdown

- Prefer the public CLI package: `npm i -g @mibatt/dietu@latest`

Technical Analysis

The skill directs the user or agent to globally install the mutable latest release of @mibatt/dietu. The project does not contain the package source, an exact reviewed version, a lockfile, or an integrity hash with which to verify the downloaded artifact.

npm packages can define installation lifecycle scripts that execute during installation. Because @latest can resolve to different package contents over time, the effective code executed by this instruction may change after the skill itself has been reviewed. This creates a supply-chain risk if the package publisher, maintainer account, npm registry path, or a future release is compromised.

This finding does not establish that the current @mibatt/dietu package is malicious. The vulnerability is the unsafe dependency acquisition pattern and the inability to reproduce or validate the installed code from the audited project.

Attack Path

1. An attacker compromises the package publisher account, release pipeline, or another component controlling the npm package.
2. The attacker publishes a malicious release and assigns it to the latest distribution tag.
3. A user or agent follows the skill instruction and runs npm i -g @mibatt/dietu@latest.
4. npm downloads the attacker-controlled package and may execute its lifecycle scripts.
5. The malicious code runs with the privileges of the user performing the installation and installs or replaces a globally available dietu command.
6. Subsequent CLI invocations may expose credentials, alter command results, or perform arbitrary actions available to that user.

Impact Assessment

Successful exploitation could execute arbitrary code wi ...[truncated 551 chars]

Remediation

View remediation

Remediation Suggestions

• Replace @latest with an exact, reviewed package version.
• Publish and verify the expected npm integrity digest before installation.
• Document the canonical package registry and source repository.
• Prefer a project-local installation with a committed lockfile instead of a global installation.
• Review package contents and lifecycle scripts before approving a new version.
• Use --ignore-scripts when lifecycle scripts are not required.
• Run the CLI under a dedicated least-privileged account and expose credentials only to commands that require them.
• Establish an explicit dependency-update process that reviews each new version before changing the pinned version.

T08 · Insecure Dependencies

Warning

• Location: references/auth.md:7

Finding

Authentication Guide Recommends Unpinned Global npm Installation

Content

View full analysis

Vulnerability Details

File Location: references/auth.md:7-9
Vulnerability Type: Unpinned third-party dependency installed globally
Risk Level: Medium

Vulnerable Code

bash

npm i -g @mibatt/dietu@latest

Technical Analysis

The authentication documentation repeats the instruction to globally install the mutable latest release of @mibatt/dietu. The downloaded package is outside the audited project, and this project provides no exact resolved version, lockfile, source snapshot, or integrity value that would allow the installed artifact to be validated.

Global npm installation can execute package lifecycle scripts. A later package release can therefore introduce executable behavior without any modification to this skill package. The risk is particularly relevant in this file because the installed tool is subsequently expected to handle Dietu PATs, session JWTs, and legacy password-based authentication.

This finding identifies a supply-chain exposure and does not assert that the currently published package contains malicious code.

Attack Path

1. An attacker gains control over the npm publisher account, package release process, or another trusted distribution component.
2. The attacker publishes a modified package under the legitimate name and moves the latest tag to that release.
3. A user follows the authentication installation guide.
4. npm installs the malicious release globally and may execute attacker-controlled lifecycle scripts.
5. The installed CLI is later invoked with DIETU_ACCESS_TOKEN, a session JWT, or legacy email and password credentials.
6. Malicious CLI code can read those credentials from arguments, environment variables, configuration files, or process memory and misuse or disclose them.

Impact Assessment

Exploitation could result in arbitrary code execution with the installing user's privileges and compromise of credentials made available to the CLI. A s ...[truncated 482 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the CLI to an exact version that has undergone security review.
• Supply a lockfile or verified integrity hash for reproducible dependency resolution.
• Prefer project-local installation and execution through an explicitly pinned package.
• Verify package provenance, registry origin, release signatures, and lifecycle scripts.
• Disable npm lifecycle scripts during installation when the package does not require them.
• Avoid passing credentials directly through command-line arguments where they may be exposed in process listings or shell history; prefer a protected environment or secret manager.
• Limit PAT permissions and lifetime, rotate credentials after suspected dependency compromise, and isolate automation under a least-privileged operating-system account.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (5)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 45)May include surrounding context.

md

Important:

- The primary interactive path is GitHub device flow
- The recommended automation path is PAT from `Settings / Access Tokens`
- Do not invent outdated commands such as `dietu ping` or `dietu mcp start`

## Command recipes

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/auth.md (reported line 52)May include surrounding context.

md

Recommended path:

- Create a PAT in Dietu web `Settings / Access Tokens`
- Put that PAT into `DIETU_ACCESS_TOKEN`

Examples:

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The documentation shows password-based login using a literal --password command-line argument, which can expose credentials through shell history, process listings, terminal logging, and agent telemetry. Even though labeled as a compatibility fallback, presenting this pattern without an explicit warning or safer alternative creates a real credential-handling risk.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The file is primarily written in English, but the inline comments on these example commands switch to Chinese. This imposes a language assumption on readers without opt-in or justification, which can violate organizational language/locale policy for general-purpose skills.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The file is primarily written in English, but the example comments switch to Chinese on these lines. This can impose a language/locale preference without user opt-in, which matches the policy category for language or locale violations.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.