T08 · Insecure Dependencies
Warning
- Location
SKILL.md:35- Finding
Unpinned Third-Party npm Package Installation and Execution
- Content
View full analysis
- Remediation
View remediation
Security audit
File2md
Security checks for vulnerabilities and agentic risk
Overview
The skill is a straightforward document-to-Markdown helper, but users should understand it installs and runs an unpinned npm CLI and has optional cloud conversion modes.
Install only if you are comfortable running the @covoyage/file2md npm package in your environment. For sensitive documents, prefer a pinned or vetted package version and avoid Azure cloud flags unless you explicitly intend to send the document to those services.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 92% confidence
- Finding
The skill instructs use of
npx @covoyage/file2mdwithout pinning a specific version, which means execution depends on whatever package version is current at runtime. This creates a supply-chain risk: a malicious or compromised upstream release could be fetched and executed unexpectedly, especially in automated agent contexts where commands may run without manual review.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 92% confidence
- Finding
This unpinned
npx @covoyage/file2mdinvocation can download and run the latest published package version at execution time. In an agent skill, that increases exposure to upstream package compromise, typosquatting/substitution mistakes, or breaking changes that alter behavior unexpectedly.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 92% confidence
- Finding
The workflow explicitly recommends
npx @covoyage/file2md <path>without version pinning, so an agent may execute an unreviewed package release in production. Because this is operational guidance rather than incidental text, it materially increases the chance of unsafe command execution from the public registry.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill documents optional Azure Document Intelligence and Content Understanding modes but does not clearly warn that enabling them may transmit document contents, including potentially sensitive files, to external cloud services. In a document-conversion skill, users may reasonably expect local-only processing unless disclosure and consent requirements are made explicit.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The description embeds Chinese trigger phrases alongside English usage guidance, implying a language-specific activation policy without stating that trigger language is optional or user-selected. Under the language/locale policy, skills should avoid imposing a specific language unless the user has opted in or the locale constraint is justified.
- Content
Static analysis
No suspicious patterns detected.