XiaChat CLI — AI Personality Matching

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 8:25 AM UTC
• Version: 1.0.0

Overview

The skill is a straightforward XiaChat CLI usage guide, but users should understand it installs an unpinned global npm CLI and sends personality/chat data to XiaChat services.

Install only if you are comfortable using XiaChat's npm CLI and sending selected SOUL profiles, imported chat transcripts, match interactions, and API-authenticated requests to XiaChat. Prefer a least-privileged or isolated environment, avoid importing conversations without consent, and consider pinning or verifying the npm package before global installation.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:17

Finding

Unpinned Global Installation of a Third-Party npm Package

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 17
Vulnerability Type: Unpinned and unverified third-party dependency installation
Risk Level: Medium

Vulnerable Code

bash

npm install -g xiachat

Technical Analysis

The setup instructions install the latest available release of the xiachat npm package globally. No exact version, integrity value, lockfile, reviewed source reference, or other verification mechanism is provided.

npm packages can execute lifecycle scripts during installation. Because the package implementation is not included in this project, its behavior cannot be audited from the available artifact. The command therefore delegates code execution to mutable content obtained from a third-party package registry.

Global installation increases exposure by making the executable available throughout the user's environment. Depending on the local npm configuration, installation may also be performed with elevated privileges, although elevated execution is not explicitly requested by this Skill.

This finding does not establish that the current xiachat package is malicious. The vulnerability is the unsafe dependency acquisition process, which could expose users to a compromised maintainer account, malicious package release, registry compromise, or package-name takeover.

Attack Path

1. An attacker compromises the package publisher, registry entry, or another part of the distribution chain for the xiachat package.
2. The attacker publishes a malicious release under the same package name.
3. A user or Agent follows the Skill instructions and runs npm install -g xiachat.
4. npm resolves the mutable package name to the attacker-controlled release.
5. Malicious lifecycle scripts or package code execute with the permissions of the user running npm.
6. The malicious code can access resources available to that account, potentially including the XiaChat API key, SOUL profiles, ...[truncated 676 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the CLI to a specific reviewed version, such as xiachat@X.Y.Z, rather than installing the latest release by package name.
2. Publish the expected package source repository, publisher identity, version, and integrity digest so users can verify provenance.
3. Prefer a project-local installation governed by a committed lockfile instead of a global installation.
4. Verify the package tarball and inspect its lifecycle scripts before recommending it.
5. Use npm provenance and registry-signature verification where supported.
6. Disable lifecycle scripts with --ignore-scripts when they are not required. If they are required, document their purpose and ensure they have been reviewed.
7. Run the CLI under a least-privileged account or isolated environment with access limited to the files required for the requested operation.
8. Explicitly disclose whether SOUL profiles and chat transcripts are transmitted to remote services, and obtain informed user confirmation before processing those files.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill explicitly processes sensitive personal data such as SOUL profiles, chat logs, match results, and API credentials, and it encourages importing/exporting that data and sending it to a third-party service without any privacy, consent, retention, or transmission warning. This is dangerous because users may unknowingly expose intimate behavioral data or credentials to external systems, especially when using chat exports, pipeline automation, or shared terminal environments.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.