Agent Content Pipeline

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:00 AM UTC
• Version: 0.2.3

Overview

The skill is mostly coherent, but it installs an unpinned global CLI that handles social posting and browser/session credentials, so users should review it before installing.

Install only after you are comfortable trusting the npm package and publisher with local content plus social-account posting flows. Prefer a pinned reviewed version, use dry runs first, keep credentials isolated, and do not give the CLI browser tokens or cookies unless you intend it to post through those accounts.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:8

Finding

Unpinned Global npm Dependency Creates a Supply-Chain Execution Risk

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:8-11; skill.json:11-17
Vulnerability Type: Unpinned third-party package installed globally
Risk Level: Medium

Vulnerable code in SKILL.md:

bash

npm install -g agent-content-pipeline
content init . # Creates folders + global config (in current directory)

Vulnerable code in skill.json:

json

"install": [
  {
    "id": "npm",
    "kind": "node",
    "package": "agent-content-pipeline",
    "bins": ["content", "content-pipeline"],
    "label": "Install content (npm)"
  }
]

Technical Analysis

The installation instructions and manifest identify the npm package only by name, without an exact version, package-lock file, registry restriction, or integrity hash. Consequently, installation resolves whichever release the configured npm registry currently serves. The audited project contains only SKILL.md and skill.json; it does not contain the dependency's executable implementation, so the behavior and security properties of the installed CLI cannot be verified from this artifact.

npm packages can run lifecycle scripts during installation. A global installation can therefore execute package-controlled code under the installing user's account and place executable commands in a globally accessible binary location. The documented workflow subsequently trusts those commands with local content, configuration, and social-platform authentication material.

This finding does not establish that the named package is currently malicious. The vulnerability is the absence of dependency pinning and integrity controls, which allows the effective executable implementation to change after this Skill has been reviewed.

Attack Path

1. An attacker compromises the publisher account, npm package, package release process, or registry resolution path for agent-content-pipeline.
2. The attacker publishes a malicious release under the sa ...[truncated 1385 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the dependency to a reviewed exact version, for example agent-content-pipeline@0.2.3, rather than resolving the latest release.
2. Record and verify the package's integrity digest through a lockfile or an equivalent immutable integrity mechanism.
3. Restrict installation to the expected npm registry and document package provenance verification.
4. Prefer a project-local installation over npm install -g to reduce system-wide exposure and make dependency resolution reproducible.
5. Review the dependency's source, release artifact, transitive dependencies, and npm lifecycle scripts before approving a version.
6. Disable lifecycle scripts during installation where operationally feasible, then explicitly run only reviewed setup steps.
7. Execute the CLI with least privilege and isolate it from unrelated files and credentials.
8. Keep social-platform credentials in a protected credential store and ensure they are disclosed only to a verified posting process.
9. Add automated dependency monitoring and require renewed review whenever the pinned version or integrity digest changes.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

Line L098 instructs the agent to use Dutch for NL audiences as a default stylistic requirement. This is a natural-language locale policy constraint, and the file does not indicate that the user can choose or opt in to that language behavior.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.