unkey-cli

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 7:52 AM UTC
• Version: 1.0.1

Overview

This skill is a straightforward Unkey CLI helper, but users should be careful with root keys and the unpinned global CLI install.

Install only from Unkey’s official package or release channel, prefer a pinned and verified version when possible, and avoid exposing root keys in prompts or logs. Review Unkey mutations carefully, especially key, permission, role, and delete operations.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:47

Finding

Unpinned Global Installation of a Third-Party CLI

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 47
Vulnerability Type: Unpinned and unverified third-party dependency installation
Risk Level: Medium

Vulnerable Code

bash

npm install -g unkey

The installation guidance also suggests downloading a platform binary from GitHub Releases at line 50 without specifying an exact repository, version, checksum, or signature-verification procedure.

Technical Analysis

The skill instructs users or agents to install the latest available unkey package globally from the npm registry. It does not pin a reviewed version or require verification of package provenance and integrity. A global installation can execute package lifecycle scripts and places executable files in the user's global npm environment.

Consequently, the effective code installed by this instruction may change after the skill has been audited. A compromised npm account, malicious package release, registry compromise, or incorrect package resolution could cause attacker-controlled code to be installed. The alternative GitHub Releases guidance has a similar verification weakness because it does not identify the exact official repository or require signature or checksum validation.

Attack Path

1. An attacker compromises the relevant package-publishing account or release channel, or otherwise causes a malicious version to be resolved under the referenced package name.
2. A user or agent follows the skill's installation instruction without selecting a previously reviewed version.
3. npm downloads and globally installs the attacker-controlled release.
4. Malicious lifecycle scripts may execute during installation, or malicious behavior may execute when the installed unkey command is invoked.
5. The malicious process operates with the privileges of the user performing the installation and may access resources available to that account, potentially including Unkey credentials used during ...[truncated 755 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the CLI to a specifically reviewed release, for example:

   bash

   npm install -g unkey@<reviewed-version>
   

2. Record the approved version in the skill and establish a controlled process for reviewing and updating it.
3. Identify the exact official npm package scope and official GitHub repository rather than referring generically to GitHub Releases.
4. Publish and verify cryptographic checksums or signatures for downloaded binaries before execution.
5. Where supported, validate npm package integrity through a lockfile or trusted package manifest and use a trusted registry configuration.
6. Avoid elevated privileges during installation and execution. Prefer an isolated environment or temporary package runner with an explicitly pinned version when practical.
7. Review package lifecycle scripts and consider disabling them during installation when they are unnecessary and compatibility has been verified.
8. Document removal and credential-rotation procedures for cases where a downloaded release is later determined to be compromised.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The manifest description is partly in Chinese and partly in English, but the skill does not state that the user may choose their preferred language. This can violate language/locale policy because the skill implicitly fixes its communication language rather than offering an explicit opt-in or choice.

Content

No source excerpt is available for this finding.