T08 · Insecure Dependencies
Warning
- Location
SKILL.md:159- Finding
Unpinned Packages Executed Through npx
- Content
View full analysis
- Remediation
View remediation
Security audit
Contribute Catalog
Security checks for vulnerabilities and agentic risk
Overview
This contribution skill is coherent, but it needs review because it asks users to run unpinned external tools and generated templates load third-party scripts while publishing content.
Install only if you are comfortable reviewing and running the contribution commands yourself. Prefer running the workflow in a clean checkout or container, pin or use locked project dependencies for hyperframes, oxfmt, and tsx, and be aware that generated HTML templates fetch scripts from public CDNs unless you vendor or add integrity controls.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T03 · Remote Payload Retrieval and Execution
Warning
- Location
templates.md:13- Finding
Externally Hosted JavaScript Executes Without Integrity Verification
- Content
View full analysis
``` VFX template: ```html ``` Component template: ```html ``` ### Technical Analysis The generated HTML templates load executable JavaScript directly from `cdn.jsdelivr.net`. Although the package URLs include version numbers, the script elements do not contain Subresource Integrity hashes. The browser or rendering engine therefore verifies only transport security and does not verify that the returned script bytes match a previously reviewed artifact. The effective payload remains dependent on external CDN and package infrastructure after the Skill itself has been reviewed. A compromised CDN response, compromised upstream package artifact, malicious registry replacement, or failure in the external delivery chain could cause modified JavaScript to execute whenever a composition is previewed or rendered. The remote Google Fonts stylesheet also generates a third-party network request and exposes ordinary request metadata, but it is not itself treated as a confirmed executable-code vulnerability in this report. ### Attack Path 1. An attacker compromises the CDN delivery path, an upstream package artifact, or infrastructure capable of changing the response for one of the referenced script URLs. 2. A contributor creates a composition by copying one of the provided templa ...[truncated 1441 chars]- Remediation
View remediation
``` 3. Generate hashes from independently obtained, trusted artifacts and verify them during dependency updates. 4. Apply the same protection to every remote executable script in all templates. 5. Enforce a restrictive Content Security Policy that permits scripts only from approved locations and disallows unexpected connections. 6. Run previews and rendering jobs in a sandbox with no sensitive environment variables, credentials, local-file bridges, or unnecessary network access. 7. Mirror approved dependencies in controlled infrastructure if offline vendoring is not practical. 8. Add automated linting that rejects remote script elements without approved origins, fixed versions, and valid integrity metadata. ]]>
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Rogue AgentSelf-Modification, Session Persistence
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (9)
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 92% confidence
- Finding
The skill instructs use of
npx hyperframeswithout pinning an exact package version.npxmay resolve and execute the latest published package or a locally shadowed package, which creates a supply-chain risk if an upstream release is compromised or behavior changes unexpectedly. In a skill that guides contributors through publishing and PR workflows, this can directly lead to execution of unreviewed code on the user's machine.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 89% confidence
- Finding
The instruction uses
npx oxfmtwithout an exact version, allowing execution of whatever package version is currently resolved from the registry. This exposes contributors to supply-chain compromise or unexpected formatter behavior, especially because the command is intended to be run on developer workstations during contribution flow.- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 80% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md # 2. Format HTML npx oxfmt registry/{kind}/{name}/*.html # 3. Update registry/registry.json — add entry to the "items" array: # { "name": "{name}", "type": "hyperframes:block" } (or "hyperframes:component") # 4. Generate catalog docs page
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 90% confidence
- Finding
The skill calls
npx tsx scripts/generate-catalog-pages.tswithout pinningtsxto a specific version. Becausetsxexecutes JavaScript/TypeScript code, an unpinned resolution increases the risk of arbitrary code execution through a malicious or compromised package version or dependency tree.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 92% confidence
- Finding
This is another unpinned
npx hyperframesinvocation, here used for publishing. Publishing-related commands are especially sensitive because they may handle credentials, upload content, or affect remote state, so executing an unpinned package heightens the supply-chain risk.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 89% confidence
- Finding
The quality gate references
npx oxfmt --checkwithout version pinning. Even though this is a check step, it still executes downloaded code and therefore carries the same supply-chain and reproducibility risks as other unpinnednpxcommands.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 92% confidence
- Finding
The quality gate again instructs
npx hyperframes publishwithout pinning a version. Because this command likely performs networked publishing and may use credentials or project metadata, unpinned execution materially increases the impact of a compromised upstream package.- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The caption template instructs users to load third-party assets from public CDNs (Google Fonts and jsDelivr) at runtime without any disclosure or integrity controls. This creates a supply-chain and privacy risk because generated artifacts will make external requests and will trust whatever script/font content is served at execution time.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The VFX template loads GSAP and Three.js directly from a CDN, again without warning users that the produced composition depends on third-party network resources. In a contribution skill that helps publish upstream registry items, this risk propagates into reusable public catalog content and increases exposure to supply-chain tampering or unexpected outbound requests.
- Content