Create Agent App

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 10:40 AM UTC
• Version: 1.0.0

Overview

This is a coherent TypeScript agent-app generation skill with explicit user confirmation and approval gates, though its README install command is mutable and should be pinned.

Install from a pinned, reviewed commit or release when possible, and review the generated brief before granting file-write, package-install, network, database, browser, or secret access. The skill's own instructions require confirmation and approval gates, so do not bypass those steps.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: README.md:7

Finding

Unpinned Third-Party Skill Installation

Content

View full analysis

Vulnerability Details

File Location: README.md, lines 7-10
Vulnerability Type: Supply-chain risk from mutable and unpinned remote dependencies
Risk Level: Medium

Complete Code Snippet:

markdown

## Install

```bash
npx skills add github:LeoGoat2004/create-agent-app

text

### Technical Analysis

The documented installation command invokes the `skills` npm CLI through `npx` without specifying a fixed package version. It also installs the Skill from a GitHub repository reference that is not pinned to an immutable commit SHA or verified integrity digest.

Both sources may therefore resolve to content that differs from the version reviewed during this audit. If the npm package, repository, maintainer account, release process, or default branch is compromised or modified, the same command could retrieve and install altered Skill instructions or additional files. Because agent Skill text can influence subsequent tool use and generated code, mutable installation sources create a meaningful supply-chain trust boundary.

This is a distribution-time vulnerability rather than evidence that the currently audited repository contains a malicious payload. No embedded malicious scripts were found in the reviewed project.

### Attack Path

1. An attacker compromises the npm package used by `npx`, the GitHub maintainer account, or the referenced repository.
2. The attacker publishes a malicious package version or changes the repository's mutable default branch.
3. A user runs the documented installation command.
4. `npx` resolves an unpinned CLI version, and the installer resolves the GitHub reference without an immutable commit constraint.
5. The altered Skill is installed and later loaded by the agent.
6. Malicious instructions or files may then act within the permissions available to the agent, subject to host-level controls and user approval requirements.

### Impact Assessment

Successful exploitation co
...[truncated 638 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the npm installer to a reviewed, exact version rather than relying on the version selected by npx:

   bash

   npx --yes skills@<exact-reviewed-version> add github:LeoGoat2004/create-agent-app#<full-commit-sha>
   

   Confirm that the installer supports commit-qualified GitHub references before publishing this syntax.

2. Pin the Skill source to a full immutable Git commit SHA, not a branch, tag, or default repository reference.

3. Publish checksums or signed release artifacts and document how users should verify integrity before activation.

4. Prefer a verified package or release channel with protected releases, mandatory multi-factor authentication, branch protection, and reviewed publishing workflows.

5. In automated environments, use a lockfile or equivalent installation manifest that records exact resolved versions and integrity metadata.

6. Advise users to inspect the downloaded Skill contents before enabling implicit invocation or granting filesystem, shell, network, browser, database, or secret access.

7. Add periodic dependency and provenance verification to the release process so that the documented command is tested against the exact reviewed artifacts.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (4)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/safety-policy.md (reported line 9)May include surrounding context.

md

Require approval for:

- shell commands that modify files, install packages, start external services, or access secrets
- file writes outside the target project
- deletes and recursive moves
- database writes or migrations

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill enables implicit invocation while exposing a very broad default prompt that can be matched by many ordinary requests about building or refactoring TypeScript agent apps. Without narrow trigger constraints or explicit user confirmation, the platform may auto-activate this skill in contexts the user did not intend, increasing the chance of overbroad code generation, unintended tool use, or unsafe workflow changes.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/generation-contract.md (reported line 105)May include surrounding context.

md

- the user has not confirmed the decision gate
- the requested provider/framework requires current API details but official docs cannot be checked and local package types are unavailable
- required permissions would be unsafe without approval
- the user asks to embed real credentials
- the requested output would be only a decorative demo