Understand-Anything-Dashboard

• Outcome: Review
• Latest audit: Sep 12, 2026 · 8:16 AM UTC
• Version: 1.1.0

Overview

The skill is purpose-aligned for launching a dashboard, but it asks the agent to install and execute JavaScript tooling with unsafe fallback behavior and to start a background server/browser without tight safeguards.

Review this skill before installing. It is not showing clear malicious intent, but it can install dependencies, execute JavaScript tooling, start a background local server, and open a browser. Prefer a version that fails closed on frozen-lockfile errors, uses pnpm exec or a pinned local Vite binary, quotes paths safely, and asks before installing packages or launching the browser.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:30
• Finding: Unpinned Dependency Installation and Execution<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 30-34 **Vulnerability Type**: Supply-chain exposure through unrestricted package installation and execution **Risk Level**: High ### Vulnerable Code ```bash cd <dashboard-dir> && pnpm install --frozen-lockfile 2>/dev/null || pnpm install ``` ```bash cd <dashboard-dir> && GRAPH_DIR=<project-dir> npx vite --open ``` ### Technical Analysis The skill first attempts installation with a frozen lockfile but automatically falls back to an unrestricted `pnpm install` if the initial command fails. This fallback can resolve package versions that are not fixed by the reviewed lockfile, weakening dependency integrity guarantees. The subsequent use of `npx vite --open` also does not explicitly require a pinned, locally installed Vite binary. If the executable is unavailable locally, `npx` may offer to retrieve and execute a package from the configured registry. Package installation can additionally execute dependency lifecycle scripts with the privileges of the user running the skill. This creates a supply-chain code-execution boundary in which package registry contents, dependency metadata, lockfile state, and package lifecycle scripts can influence locally executed code. ### Attack Path 1. The dashboard has a missing, invalid, outdated, or incompatible lockfile, or the frozen installation otherwise fails. 2. The `|| pnpm install` fallback performs dependency resolution without requiring the reviewed lockfile to remain unchanged. 3. An attacker-controlled or compromised dependency version is selected from the configured package registry. 4. Malicious code runs through an installation lifecycle script or when the dashboard package is loaded. 5. Alternatively, if no local Vite executable is available, `npx vite` retrieves or executes a registry-supplied package. 6. The package executes with the privileges and environment access of the user who invoked the skill. ### Impact Assessment Successful ...[truncated 503 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Require a reviewed and committed lockfile, and terminate if frozen installation fails: ```bash cd -- "$dashboard_dir" || exit 1 pnpm install --frozen-lockfile || exit 1 ``` 2. Do not silently fall back to an installation that can update dependency resolution. 3. Declare Vite as a pinned local dependency and invoke it without registry fallback: ```bash pnpm exec vite --open ``` 4. Validate that the resolved executable belongs to the reviewed dashboard installation before running it. 5. Review dependency lifecycle scripts and use `--ignore-scripts` where installation scripts are unnecessary. 6. Pin the package manager version and verify the integrity and provenance of the lockfile and downloaded packages. 7. Avoid suppressing installation errors with `2>/dev/null`; report failures so users can make an informed decision. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:30
• Finding: Unsafe Shell Interpolation and Incorrect Installation Fallback Scope<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 30-34 **Vulnerability Type**: Shell command injection and unintended command execution directory **Risk Level**: High ### Vulnerable Code ```bash cd <dashboard-dir> && pnpm install --frozen-lockfile 2>/dev/null || pnpm install ``` ```bash cd <dashboard-dir> && GRAPH_DIR=<project-dir> npx vite --open ``` ### Technical Analysis The instructions direct the Agent to place the resolved dashboard directory and the user-selected project directory directly into shell commands. They do not require shell-safe quoting, argument-based process invocation, canonicalization, or rejection of shell control characters. If an implementation substitutes a path literally, characters such as spaces, semicolons, command substitutions, redirection operators, or shell metacharacters can change command parsing. The project path is derived from `$ARGUMENTS`, making it potentially user-controlled. The dependency command also has unsafe fallback semantics: ```bash cd <dashboard-dir> && frozen-install || unrestricted-install ``` Shell `&&` and `||` operators have equal precedence and are evaluated left-to-right. Consequently, the final `pnpm install` runs when either `cd` or the frozen installation fails. If `cd` fails, the unrestricted installation executes in the process's existing working directory rather than the intended dashboard directory. ### Attack Path #### Path-based command injection 1. An attacker supplies a project path containing shell syntax, or causes the resolved dashboard path to contain shell metacharacters. 2. The Agent replaces `<project-dir>` or `<dashboard-dir>` with that value without robust shell quoting. 3. The shell interprets the injected characters as syntax rather than as part of a filesystem path. 4. Attacker-selected commands execute with the privileges of the Agent user. #### Wrong-directory dependency installation 1. Dashboard path resolution produces an invalid, unavailab ...[truncated 937 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Treat all user-provided and resolved paths as untrusted. 2. Canonicalize paths and verify expected file types before use: - Confirm that the project path is an existing directory. - Confirm that the dashboard path resolves beneath the trusted plugin root. - Confirm that the knowledge graph is a regular file at the expected location. 3. Quote every shell-expanded path: ```bash cd -- "$dashboard_dir" || exit 1 GRAPH_DIR="$project_dir" pnpm exec vite --open ``` 4. Prefer structured process-execution APIs that pass arguments as arrays rather than constructing shell command strings. 5. Reject path values containing NUL bytes or other unsupported control characters. 6. Remove the unrestricted fallback and fail closed: ```bash if ! cd -- "$dashboard_dir"; then printf '%s\n' "Dashboard directory is unavailable." >&2 exit 1 fi if ! pnpm install --frozen-lockfile; then printf '%s\n' "Dependency installation failed." >&2 exit 1 fi ``` 7. If a fallback is operationally required, explicitly group it after a successful directory change and require user confirmation before changing dependency resolution. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill performs `pnpm install` automatically without an explicit warning or confirmation, which executes package installation logic and may run lifecycle scripts from project dependencies. This is a meaningful code-execution and supply-chain risk, especially in environments where dependency contents are not fully trusted.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill starts a background dev server and uses `--open`, which causes an external side effect by launching the user's browser automatically. Because the instructions do not require explicit confirmation before opening a browser and spawning a long-running process, the skill can surprise users, expose local project metadata in a UI, or trigger unintended network/service behavior.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 86% confidence
• Finding: The skill launches `npx vite` without pinning a specific local dependency or version, which can cause execution of whatever `vite` version is resolved at runtime. If the package is missing locally or the environment is manipulated, this creates supply-chain and reproducibility risk by fetching or invoking untrusted code during skill execution.

Static analysis

No suspicious patterns detected.