Css Animations

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 8:44 AM UTC
• Version: 1.0.0

Overview

This skill is a small CSS animation guidance document with one supply-chain caution around optional validation commands.

Before running the validation commands, prefer a project-pinned HyperFrames dependency or an exact npx package version so the executed CLI is reviewed and reproducible.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:116

Finding

Unpinned npm Package Execution Through npx

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 116–117
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code:

bash

npx hyperframes lint
npx hyperframes validate

Technical Analysis

The validation instructions invoke hyperframes through npx without specifying an exact version. The audited project contains no package manifest, lockfile, integrity hash, or vendored executable that constrains which implementation will run.

Depending on the npm version, local environment, cache state, and configuration, npx may resolve and download the package from an external npm registry before executing its CLI. Consequently, the effective executable is outside the audited project and may change after this Skill has been reviewed.

Attack Path

1. A user follows the validation commands documented in SKILL.md.
2. npx searches for a suitable local hyperframes executable.
3. If no trusted local copy exists, npm may resolve and download the package from its configured registry.
4. A compromised, replaced, or unexpectedly changed package version is selected.
5. Package lifecycle scripts or CLI initialization code executes under the invoking user's account.
6. The malicious dependency performs actions allowed by that account, such as reading accessible files, modifying project content, or initiating network connections.

Impact Assessment

Successful exploitation could execute arbitrary code with the privileges of the user running the documented commands. The accessible scope may include the current project, user-readable files, environment variables, npm credentials, and any network or filesystem resources available to that account. The commands do not inherently grant administrative privileges, so the maximum impact remains constrained by the invoking user's existing permissions and environment.

Remediation

View remediation

Remediation Suggestions

• Declare hyperframes as a project dependency or development dependency using an exact reviewed version.
• Commit a lockfile containing the resolved package version and integrity metadata.
• Install dependencies with lockfile enforcement, such as npm ci, rather than allowing unconstrained resolution.
• Invoke only the verified local executable, for example:

  bash

  npm exec --offline -- hyperframes lint
  npm exec --offline -- hyperframes validate
  

• Configure npm to reject unexpected lifecycle scripts where feasible, and review any scripts required by the dependency.
• Verify package provenance, publisher identity, registry source, and integrity before approving version updates.
• Perform dependency updates through a controlled review process with automated supply-chain scanning.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The documentation instructs users to run npx hyperframes without pinning an exact package version. npx may fetch the latest published package at execution time, so a compromised upstream release, dependency confusion issue, or unexpected breaking update could result in execution of unreviewed code on the user's machine. In this skill context, the risk is more significant because the commands are presented as routine validation steps that users may copy-paste directly.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The second command repeats the same unsafe pattern by invoking npx hyperframes without a pinned version. This can cause users to execute whatever version is current in the registry at the time, creating supply-chain exposure and reducing reproducibility of security-sensitive tooling behavior. Because this appears in a validation section, users are especially likely to trust and run it verbatim.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.