T08 · Insecure Dependencies
Error
- Location
SKILL.md:23- Finding
Unpinned Third-Party Package Installation and Execution
- Content
View full analysis
- Remediation
View remediation
Security audit
@kanyun/rush-reskill-usage
Security checks for vulnerabilities and agentic risk
Overview
This skill is not malicious, but it gives an agent broad skill-management powers through a mutable third-party CLI and weakly scoped confirmation and token guidance.
Install only if you intend to let an agent manage skills and possibly publish to the reskill registry. Prefer a pinned, reviewed reskill version; avoid `npx ...@latest`, `--all`, global installs, and `-y` unless you explicitly want that scope; do not paste real tokens into command lines or shared agent transcripts.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:263- Finding
Registry Authentication Token Exposed Through Command-Line Arguments
- Content
View full analysis
# Check current login status reskill whoami ``` ``` ### Technical Analysis The documented authentication command instructs users to place a registry token directly in a command-line argument. When the placeholder is replaced with a real secret, that secret can be exposed through several channels: - Interactive shell history - Terminal session recording - CI/CD command logs - Agent transcripts and tool-call records - Process-argument inspection by other local processes, depending on the operating system - Diagnostic or monitoring products that capture process command lines Although the document also mentions the `RESKILL_TOKEN` environment variable elsewhere, environment variables are not a complete mitigation because they can be inherited by child processes or exposed through diagnostics. A non-echoing interactive prompt, protected standard input, or a dedicated secret-manager integration is preferable. ### Attack Path 1. A user obtains a valid registry token. 2. Following the Skill, the user replaces `` with the real credential and executes the command. 3. The complete command is retained in shell history, CI logs, terminal recordings, an agent transcript, or process-monitoring data. 4. An attacker with access to one of those records retrieves the token. 5. The attacker authenticates to the configured registry as the victim. 6. Subject to the token's assigned scope, the attacker publishes or replaces skills, accesses private registry resources, or impersonates the account. ### Impact Assessment The privileges obtained are limited by the exposed token's registry scopes. Potential co ...[truncated 452 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (8)
Self-Modification
High
- Category
- Rogue Agent
- Confidence
- 85% confidence
- Finding
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
- Content
md | `install [skills...]` | `i` | Install one or more skills | | `list` | `ls` | List installed skills | | `info <skill>` | - | Show skill details | | `update [skill]` | `up` | Update skills | | `outdated` | - | Check for outdated skills | | `uninstall <skill>` | `un`, `rm`, `remove` | Remove a skill | | `publish [path]` | `pub` | Publish a skill to the registry ¹ |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md **Requirements**: The specified directory must contain a valid `SKILL.md` file following the [Agent Skills Specification](https://agentskills.io).
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md **Requirements**: The specified directory must contain a valid `SKILL.md` file following the [Agent Skills Specification](https://agentskills.io).
Self-Modification
High
- Category
- Rogue Agent
- Confidence
- 85% confidence
- Finding
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
- Content
reskill update
Update a specific skill
reskill update skill-name
text ### Global vs Project-Level Installation
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 85% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md | `-a, --agent <agents...>` | `install` | Specify target agents (e.g., `cursor`, `claude-code`) | | `--mode <mode>` | `install` | Installation mode: `symlink` (default) or `copy` | | `--all` | `install` | Install to all agents | | `-y, --yes` | `install`, `uninstall`, `publish` | Skip confirmation prompts | | `-f, --force` | `install` | Force reinstall even if already installed | | `-s, --skill <names...>` | `install` | Select specific skill(s) by name from a multi-skill repo | | `--list` | `install` | List available skills in the repository without installing |
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 85% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md | `-a, --agent <agents...>` | `install` | Specify target agents (e.g., `cursor`, `claude-code`) | | `--mode <mode>` | `install` | Installation mode: `symlink` (default) or `copy` | | `--all` | `install` | Install to all agents | | `-y, --yes` | `install`, `uninstall`, `publish` | Skip confirmation prompts | | `-f, --force` | `install` | Force reinstall even if already installed | | `-s, --skill <names...>` | `install` | Select specific skill(s) by name from a multi-skill repo | | `--list` | `install` | List available skills in the repository without installing |
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The authentication section shows passing a token directly on the command line and notes token storage in
~/.reskillrc, but it does not warn that CLI arguments may be captured in shell history, process listings, CI logs, or transcripts. This can lead to accidental credential disclosure, especially when an AI agent echoes commands or users copy-paste them into shared environments.- Content