ccfrank

• Outcome: Pass
• Latest audit: Sep 15, 2026 · 1:34 AM UTC
• Version: 1.0.4

Overview

This skill is a coherent CCF ranking lookup tool, but users should pin the npm package version before installing it globally.

Before installing, prefer `npm install -g ccfrank@4.5.5` or a lockfile-controlled local install so the reviewed package version is the one that runs. Install it with normal user privileges, not administrator privileges, unless you have separately reviewed the npm package.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:13

Finding

Unpinned Global npm Package Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 13-33
Vulnerability Type: Unpinned and globally installed third-party dependency
Risk Level: Medium

The installation instructions conflict with the fixed dependency metadata. Although the metadata identifies ccfrank@4.5.5 and supplies an integrity hash, the documented command globally installs the latest version available from the registry without validating that hash.

yaml

install:
  method: global-npm
  lockVersion: false
  allowGlobalInstall: true
  execution:
    command: npx
    args:
      - --no-install
      - ccfrank
---

# CCFrank

查询会议/期刊的 CCF 等级（A/B/C/E/P/none）。

## 安装配置（MCP）

全局安装 CLI（安装命令不限制版本）：

```bash
npm install -g ccfrank

Technical Analysis

The command npm install -g ccfrank does not constrain the installed package to the reviewed version 4.5.5. Consequently, it resolves the package version at installation time and may install a newer artifact whose code and integrity differ from the version declared in the Skill metadata.

Setting lockVersion: false confirms that installation is not required to honor the declared version. The global installation scope also increases exposure: npm lifecycle scripts and package binaries execute with the permissions of the user running npm and are installed into shared user-level or system-level locations. The subsequent npx --no-install ccfrank command trusts and executes whichever matching binary is available in the relevant npm environment.

This is a supply-chain weakness rather than evidence that the currently named package is malicious.

Attack Path

1. An attacker compromises the npm publisher account, package distribution process, or a future ccfrank release.
2. The attacker publishes a newer package version containing a malicious lifecycle script or CLI implementation.
3. A user follows the Skill instructions and runs `npm install -g c ...[truncated 1019 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the documented installation command to the reviewed version:

   bash

   npm install -g ccfrank@4.5.5
   

2. Set lockVersion: true and ensure the installation system enforces the metadata version rather than treating it as informational.
3. Validate the downloaded package against the declared SHA-512 integrity value before execution.
4. Prefer a project-local, lockfile-controlled installation instead of a global installation:

   bash

   npm install --save-exact ccfrank@4.5.5
   

5. Invoke the exact local binary from the locked dependency tree rather than relying on global command resolution.
6. Disable npm lifecycle scripts during installation when the package does not require them, and review any required scripts before enabling them.
7. Run the MCP server under a dedicated, least-privileged account with restricted filesystem and network access.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

The skill metadata pins the dependency to ccfrank@4.5.5, but the documented installation command uses npm install -g ccfrank without a version pin, and execution relies on npx --no-install ccfrank, which will invoke whatever globally installed version is present. This creates a supply-chain/version-drift risk where a newer or compromised package version could be installed and then executed instead of the reviewed one.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.