sync-trending

• Outcome: Review
• Latest audit: Sep 11, 2026 · 12:25 AM UTC
• Version: 0.1.0

Overview

The skill is openly about finding and testing trending projects, but it asks the agent to run arbitrary third-party code with broad local context access and only limited containment.

Install only if you are comfortable with the agent researching public trend sources and potentially testing selected repositories. Before allowing any deep dive, ask it to use a disposable container or VM with no host secrets, review the exact commit and commands, and avoid broad workspace or saved-memory access unless you explicitly need that context.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:24

Finding

Execution of Untrusted and Mutable Third-Party Projects

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 24-32
Vulnerability Type: Unsafe installation and execution of third-party repositories and dependencies
Risk Level: Medium

Vulnerable Code Snippet:

markdown

2. **Setup:**
   - Use `run_shell_command` to `git clone` the repository into a temporary directory (e.g., in `~/.gemini/tmp/`).
   - Read `README.md` or `CONTRIBUTING.md` to identify build/run instructions.
3. **Execution:**
   - Detect project type (Node.js, Python, Rust, Go, etc.).
   - Install dependencies (`npm install`, `pip install -r requirements.txt`, etc.).
   - Run the application or demo (`npm start`, `python main.py`, etc.).
4. **Verification:**
   - If it starts a web server, use `browser_navigate` to check `http://localhost:<port>`.
   - If it's a CLI tool, check the output for success/failure.

Technical Analysis

The Skill directs the Agent to clone a mutable external repository, install its dependencies, and execute its application. Although this workflow requires user permission and uses a temporary directory, neither control provides a security boundary.

A temporary directory only changes the working location. Unless execution occurs in a properly isolated environment, cloned code and package-manager lifecycle hooks retain the Agent process's filesystem, process, and network privileges. Commands such as npm install can execute package lifecycle scripts, while Python and other ecosystems may execute arbitrary code during builds or when the downloaded application is started.

The instructions do not require commit pinning, signature or provenance verification, dependency review, lifecycle-script suppression, network restrictions, filesystem isolation, or resource limits. Consequently, the code actually executed can differ from the repository state that was originally reviewed or presented to the user.

Attack Path

1. An attacker publishes or compr ...[truncated 1420 chars]

Remediation

View remediation

Remediation Suggestions

• Execute all external repositories inside a disposable container or virtual machine rather than relying on a temporary directory.
• Mount no host directories by default. If project access is necessary, provide a minimal read-only copy containing only approved files.
• Remove environment variables, credentials, SSH agents, cloud metadata access, package-manager tokens, and other secrets from the isolated environment.
• Disable outbound networking by default and allowlist only endpoints strictly required for dependency retrieval.
• Pin the repository to a specific reviewed commit and verify its origin, signature, or checksum where supported.
• Inspect dependency manifests, lockfiles, build files, and installation scripts before running package-manager commands.
• Prefer reproducible, lockfile-enforced installation modes and disable lifecycle scripts where feasible, such as npm install --ignore-scripts.
• Avoid blindly executing commands copied from repository-controlled documentation.
• Apply CPU, memory, process, execution-time, filesystem, and exposed-port limits.
• Present the exact commit, commands, network access, mounts, and isolation controls to the user before requesting execution permission.

T05 · Unauthorized Access and Privilege Escalation

Note

• Location: SKILL.md:13

Finding

Overbroad Access to Local Project Context and Persistent Agent Memory

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 13
Vulnerability Type: Excessive access to local files and cross-project memory
Risk Level: Low

Vulnerable Code Snippet:

markdown

1. **Understand Context:** Read the local `README.md`, `package.json`, or search the current directory to understand the user's project context. Check `save_memory` for user preferences or other projects.

Technical Analysis

The Skill permits an unrestricted search of the current directory and directs the Agent to inspect persistent memory concerning preferences or other projects. Trend reporting may reasonably need limited project context, but broad directory searching and cross-project memory access exceed the minimum access necessary when no path boundary, file allowlist, consent requirement, or data-minimization rule is defined.

This can place unrelated source code, internal project details, or persistent user information into the Agent's working context. The audited instructions do not direct the Agent to transmit that information to a remote service, and the referenced trend sources are public HTTPS pages. Therefore, the static pre-scan warning about sensitive information being sent over the network is not confirmed. The risk is unnecessary access and potential disclosure through generated reports rather than an explicit exfiltration mechanism.

Attack Path

1. The user invokes the Skill for a technology-trend report.
2. The Agent searches the current directory without an explicit project-root boundary or file allowlist.
3. The Agent also reads persistent memory containing preferences or information about other projects.
4. Unrelated or sensitive information enters the Agent's active context.
5. The Agent may inadvertently incorporate those details into a contextualized report or generated artifact.
6. If the resulting report is shared, information outside the intended project scope may be disclosed.

...[truncated 594 chars]

Remediation

View remediation

Remediation Suggestions

• Restrict project inspection to explicitly approved files under a clearly defined active project root.
• Default to reading only low-sensitivity metadata files such as README.md and package.json.
• Require separate user approval before searching additional files or directories.
• Do not access persistent memory or information about other projects by default.
• Ask for explicit consent before using cross-project preferences or context.
• Exclude hidden files, credential files, environment files, version-control internals, private keys, and unrelated directories.
• Summarize only the minimum project information required to contextualize trends.
• Review generated reports and artifacts for unintended project or memory disclosures before presenting or saving them.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Excessive Permissions

Low

• Category: Privilege Escalation
• Confidence: 92% confidence

Finding

This skill explicitly instructs the agent to clone arbitrary third-party repositories, install dependencies, and run their code using shell commands after only user permission. Running untrusted internet code in the same agent environment can expose local files, credentials, tokens, SSH keys, and network access, so the permission prompt does not sufficiently mitigate the risk.

Content

Scanner excerpt · SKILL.md (reported line 23)May include surrounding context.

md

### 2. Permission & Deep Dive
If the user expresses interest in a specific repository:
1. **Ask Permission:** Clearly ask: "Shall I clone [Repo Name] and attempt to run it for verification?"
2. **Setup:**
   - Use `run_shell_command` to `git clone` the repository into a temporary directory (e.g., in `~/.gemini/tmp/`).
   - Read `README.md` or `CONTRIBUTING.md` to identify build/run instructions.

Static analysis

No suspicious patterns detected.