Bytesagain License Picker

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 4:58 AM UTC
• Version: 1.0.0

Overview

This is a coherent license-reference skill that only prints documentation, with one caution that a displayed npx example could download third-party code if a user chooses to run it.

Before installing, understand that the skill appears to be documentation-only. If you copy commands from its output, especially npx license-checker --summary, run them only in an environment where you trust the package source or after pinning/reviewing the package version.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: scripts/script.sh:290

Finding

Unpinned npm Package Execution Through npx

Content

View full analysis

Vulnerability Details

File Location: scripts/script.sh:290
Vulnerability Type: Unpinned third-party dependency execution
Risk Level: Medium

Vulnerable Code

bash

npx license-checker --summary        # npm dependency licenses

Technical Analysis

The generated cheat sheet recommends executing license-checker through npx without specifying a reviewed package version or verifying package integrity. When the package is unavailable locally, npx may retrieve it from the configured npm registry and execute its current published version.

Because the resolved package content can change independently of the audited Skill, this command creates a supply-chain trust boundary. A compromised package release, registry account, registry configuration, or dependency could cause arbitrary package code or lifecycle behavior to run under the invoking user's account.

The command is printed as documentation rather than executed automatically by the Skill. Exploitation therefore requires a user or Agent to follow and run the recommendation.

Attack Path

1. A user or Agent invokes the Skill's cheatsheet command.
2. The Skill displays npx license-checker --summary as a recommended license-scanning command.
3. The user or Agent runs the displayed command in a project directory.
4. If a trusted local copy is not available, npx resolves and downloads an unpinned package from the configured npm registry.
5. A compromised or malicious package version executes with the current user's privileges.
6. The package can access files and environment data available to that user and can modify the project or other user-writable resources.

Impact Assessment

Successful exploitation permits code execution with the privileges of the user running npx. The accessible scope may include the current project, user-owned files, environment variables inherited by the process, developer configuration, and credentials ...[truncated 160 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the package to a specifically reviewed version, for example:

  bash

  npx --yes license-checker@REVIEWED_VERSION --summary
  

• Prefer installing the dependency through a project manifest and lockfile, then executing the lockfile-resolved local binary.

• Verify the package name, publisher, provenance, and integrity before recommending a version.

• Use npm integrity and provenance controls where available, and update the pinned version only after review.

• Explicitly warn users that npx may download and execute third-party code with their current account privileges.

• Recommend running scanning tools in a restricted environment without sensitive environment variables or unnecessary filesystem access.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.