Slopbuster

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 5:15 AM UTC
• Version: 1.0.0

Overview

This is a markdown-only writing cleanup skill with disclosed file editing behavior and no evidence of hidden execution or data exfiltration.

Install manually or pin and verify the Skills CLI in security-sensitive environments. Invoke the skill on specific files or text, review diffs before accepting rewrites, and only add the optional global agent instructions if you want all future agent writing to follow these style rules.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: README.md:15

Finding

Unpinned Third-Party Package Execution During Installation

Content

View full analysis

Vulnerability Details

File Location: README.md, lines 15-19
Vulnerability Type: Unpinned package execution through npx
Risk Level: Medium

Vulnerable Code

bash

npx skills add gabelul/slopbuster

One command. Auto-detects your agent, symlinks the skill. Update later with npx skills update.

Technical Analysis

The recommended installation process invokes the third-party skills package through npx without specifying a version or integrity value. If the package is unavailable locally, npx may download and execute the currently published package release. Consequently, the code executed during installation can change after this Skill has been reviewed.

The update instruction has the same trust issue: it retrieves mutable upstream content without identifying an audited version. This creates a supply-chain risk if the package, its publishing account, or one of its transitive dependencies is compromised.

This issue does not establish that the current upstream package is malicious. The risk arises because the documented command executes unpinned, externally controlled code with the user's privileges.

Attack Path

1. An attacker compromises the upstream skills package, its publisher account, or a transitive dependency.
2. The attacker publishes a malicious release under the package identity resolved by npx.
3. A user follows the README and runs npx skills add gabelul/slopbuster, or later runs npx skills update.
4. npx retrieves and executes the malicious package version.
5. The package executes with the invoking user's permissions and can access or modify resources available to that account.

Impact Assessment

Successful exploitation could run arbitrary code with the privileges of the user performing the installation. Depending on that user's environment, an attacker could modify agent configuration and Skill directories, tamper with project files, or read other user- ...[truncated 305 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the installer to an explicitly reviewed version, for example npx skills@<audited-version> add gabelul/slopbuster.
2. Use package-manager integrity verification or a lockfile where the installation workflow supports it.
3. Document the expected package registry, package identity, version, and checksum so users can verify the downloaded artifact.
4. Pin Skill updates to reviewed releases instead of recommending an unrestricted update command.
5. Prefer the documented manual-copy installation path for security-sensitive environments.
6. Advise users to inspect the resolved package and dependency tree before execution and to run installation with a minimally privileged account.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The README instructs users to run npx skills add gabelul/slopbuster without pinning a specific version of the skills package. This creates a supply-chain risk because npx will fetch and execute the latest published package at install time, so a compromised maintainer account, malicious release, or dependency hijack could result in arbitrary code execution on the user's machine.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The update instruction also uses npx skills update without version pinning, which means future executions may pull and run whatever version is current at that time. That exposes users to the same remote code execution and supply-chain compromise risks if the package or its distribution path is ever maliciously modified.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The manifest description says the skill strips AI patterns from text, code, and academic writing in very broad terms, but it does not specify concrete trigger phrases, invocation boundaries, or when the skill should not activate. In a manifest file, this can create ambiguous routing or unintended invocation because the scope overlaps with many common editing tasks.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The auto mode says it 'detects from context' and loads relevant files without defining what context is examined or what boundaries limit file access. In an agent setting, ambiguous automatic mode selection can cause unintended processing of adjacent content or over-collection of files, increasing the chance of acting on sensitive or irrelevant data.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 93% confidence

Finding

The guide explicitly instructs users to add persistent behavior into global or project-level agent instruction files so the agent applies this skill's rules to all future outputs. That creates session-persistent prompt influence beyond explicit invocation of /slopbuster, which can silently alter commit messages, code comments, documentation, and chat responses across unrelated tasks.

Content

Scanner excerpt · docs/setup-guide.md (reported line 18)May include surrounding context.

markdown

### De-AI-ify All Output

Apply `/slopbuster`'s patterns to ALL text you write — commit messages, PR descriptions,
comments, documentation, code comments, explanations in chat. Before finalizing any written
output, run it through slopbuster's rules:

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

The instruction 'Use sentence case for headings unless the publication explicitly requires title case' imposes one stylistic convention as the default. This can be read as a language/locale/style policy preference without user opt-in, especially since heading capitalization norms vary by region, publication, and house style.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.