Baz

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:38 PM UTC
• Version: 1.1.0

Overview

The skill is a disclosed Bazaar video-generation integration, but it tells agents to create accounts, handle API keys, and start payment top-up flows without a clear user-consent gate.

Install only if you intentionally want Bazaar involved. Do not let an agent create a Bazaar account, store an API key, or start top-up/payment steps unless you explicitly approve that action. Use a user-provided, revocable API key, avoid sensitive prompts or private project data unless Bazaar storage is acceptable, and prefer a pinned or otherwise verified CLI install over the unpinned global npm command shown here.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:10

Finding

Unpinned Third-Party npm Package Is Installed Globally and Trusted with an API Key

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 10-15 and 45-46
Vulnerability Type: Unpinned and unaudited third-party dependency
Risk Level: Medium

Vulnerable Code

yaml

install:
  - id: node
    kind: node
    package: bazaar.it
    bins:
      - baz

bash

npm install -g bazaar.it
baz auth login <your-api-key>

Technical Analysis

The skill instructs the agent to globally install the bazaar.it npm package without specifying a version, lockfile, package integrity hash, or other reproducibility control. Consequently, the code installed during each invocation depends on whichever package version the npm registry resolves at that time.

npm packages can execute lifecycle scripts during installation. A global installation can also place the package's executable in the user's global npm binary directory. The instructions subsequently execute that binary and provide it with a Bazaar API key through baz auth login.

The repository contains only SKILL.md; it does not include the package source or other evidence that would allow the installed implementation and its lifecycle scripts to be audited as part of this project. No evidence establishes that the current bazaar.it package is malicious. The security issue is the absence of dependency pinning and integrity controls around a package that is globally installed, executed, and entrusted with a credential.

Attack Path

1. An attacker compromises the npm package, its publisher account, or the relevant package distribution channel.
2. The attacker publishes a malicious release under the package name bazaar.it.
3. An agent follows the skill instructions and runs npm install -g bazaar.it without a pinned version.
4. npm retrieves the attacker-controlled release and may execute its installation lifecycle scripts with the installing user's privileges.
5. The installed baz executable is placed in the global ...[truncated 1234 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the dependency to a specifically reviewed version rather than installing the latest available release:

   bash

   npm install --global --ignore-scripts bazaar.it@<reviewed-version>
   

2. Verify the selected release's npm integrity metadata and publisher identity before installation. Record the reviewed version and expected integrity value in the skill documentation.

3. Prefer a project-local installation governed by a committed lockfile instead of a global installation:

   bash

   npm install --save-exact bazaar.it@<reviewed-version>
   npx --no-install baz ...
   

4. Audit the package source, transitive dependencies, and npm lifecycle scripts for the pinned release. Use --ignore-scripts when lifecycle scripts are unnecessary.

5. Run the CLI in a sandbox or container with only the filesystem and network access required for video generation. Do not expose unrelated home-directory files, SSH credentials, cloud credentials, or broad environment variables.

6. Supply a narrowly scoped API key where the service supports scoped credentials. Avoid placing the key directly in shell history or command-line arguments, and rotate it immediately if package compromise is suspected.

7. Document a trusted installation source, release-verification procedure, update-review process, and credential-revocation procedure.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The invocation guidance is broad enough that the skill could activate for generic video-related requests, increasing the chance that an agent uses this skill when the user did not intend to involve Bazaar. In context, that matters because the skill can transmit prompts and project data to an external service and steer the agent into account setup flows.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill directs the agent to create a third-party account, obtain credentials, and initiate top-up/payment flows as part of normal operation. That exceeds the core purpose of video generation and can cause unauthorized account creation or financial transactions on behalf of the user without explicit consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The workflow explicitly tells the agent to register an account and set up API authentication 'no human needed' without first obtaining user approval. This creates a direct risk of unauthorized external account creation, credential handling, and downstream billing activity.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 92% confidence

Finding

The skill instructs the agent to send requests to external Bazaar endpoints, including registration and later project/prompt submission, which transmits user and agent-supplied data off-platform. External transmission is expected for this type of integration, but it is still security-relevant here because the skill pairs it with broad activation and autonomous account setup guidance.

Content

Scanner excerpt · SKILL.md (reported line 38)May include surrounding context.

bash

# 1. Discover what Bazaar can do
curl https://bazaar.it/api/v1/capabilities

# 2. Register (one POST, no human needed)
curl -X POST https://bazaar.it/api/v1/register \

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The trigger condition 'User wants to automate video generation' is highly generic and can match many requests that do not imply consent to use this vendor. Because the skill performs external operations and may lead into credential/account workflows, overbroad triggering raises privacy and unintended-action risk.

Content

No source excerpt is available for this finding.