Beyond-UI Helper

• Outcome: Pass
• Latest audit: Sep 15, 2026 · 1:19 AM UTC
• Version: 1.1.0

Overview

This skill is a disclosed Beyond-UI install and usage helper with normal project-level package installation risks, but no evidence of hidden access, persistence, credential handling, or exfiltration.

Install this only in a project where you intend to add Beyond-UI. Review the scripts first, run package installation in a controlled environment without production secrets, rely on your lockfile or pinned versions where possible, and review the known-issues advisory notes before publishing. I also observed that install-beyond-ui.sh has a shell syntax error at its case terminator, which affects reliability rather than indicating malicious behavior.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: scripts/install-beyond-ui.sh:59

Finding

Unpinned Third-Party Dependencies Installed Despite Documented High-Severity Advisories

Content

View full analysis

Vulnerability Details

File Location: scripts/install-beyond-ui.sh:59-68; supporting advisory documentation at references/known-issues.md:3-14
Vulnerability Type: Unpinned and potentially vulnerable third-party dependencies
Risk Level: Medium

Vulnerable Code

scripts/install-beyond-ui.sh:59-68:

bash

log "Installing @beyondcorp/beyond-ui with $PACKAGE_MANAGER"
run "$INSTALL_CMD @beyondcorp/beyond-ui"

log "Ensuring peer dependencies are available"
run "$INSTALL_CMD react react-dom"

if [[ "$PACKAGE_MANAGER" == "npm" ]]; then
  # tailwindcss is optional; installing as a dev dependency when using npm
  log "Optionally installing tailwindcss (skip if not needed)"
  run "npm install -D tailwindcss"

references/known-issues.md:3-14:

markdown

## npm audit advisories (2026-03-24)

- 53 advisories (8 low / 31 moderate / 14 high) reported.
- Major upgrades pending:
  - Storybook 7 → 10 (multiple transitive advisories).
  - vite-plugin-dts ≥ 4.5.4 to address `@microsoft/api-extractor` chain.
  - tsup ≥ 8.5.1 to fix esbuild CVEs.
  - rollup ≥ 4.59.0 (path traversal).
  - react-router-dom ≥ 7.12.1 (CSRF/XSS).
  - react-syntax-highlighter 16.1.1+ (Prism security patch).
  - Misc utilities (`giget`, `tar`, `cross-spawn`, `validator`, `nanoid`, `brace-expansion`).
- Track progress via Trello #10 and note impacts before publishing.

Technical Analysis

The installation script installs @beyondcorp/beyond-ui, react, react-dom, and tailwindcss without fixed versions, reviewed version ranges, lockfile enforcement, or integrity verification. The resolved package contents can therefore change between executions even when the Skill itself has not changed.

Package-manager installation can also execute dependency lifecycle scripts with the privileges of the user running the Skill. Consequently, compromise of an allowed package release, an unsafe transitive dependency, ...[truncated 2260 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin @beyondcorp/beyond-ui and all directly installed peer dependencies to reviewed versions or narrowly constrained safe ranges.
2. Provide a reviewed lockfile and use deterministic installation such as npm ci where applicable.
3. Enforce the minimum patched versions documented in references/known-issues.md, including relevant Rollup, tsup, vite-plugin-dts, routing, and syntax-highlighting upgrades.
4. Add a pre-install or CI policy that rejects dependency graphs containing applicable high-severity advisories.
5. Verify registry configuration and package integrity before installation. Consider provenance or signature checks when supported by the package manager.
6. Review dependency lifecycle scripts before allowing them to execute. For initial inspection, consider installation with lifecycle scripts disabled, followed by explicit approval of required scripts.
7. Run installation in a least-privileged, isolated environment without production credentials or unrelated sensitive environment variables.
8. Distinguish runtime dependencies from development-only dependencies and avoid installing optional tooling unless the host project requires it.
9. Keep the advisory list synchronized with the enforced dependency versions so the installer cannot silently select releases known to remain affected.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The code only performs package installation steps and emits a reminder about importing CSS. It does not configure the library, troubleshoot issues, align Tailwind themes, run Storybook/tests/build, or provide reference behavior for components/hooks/known caveats as the description claims. While installation is part of the declared purpose, the overall declared description substantially overstates the implemented functionality, so the description does not accurately represent what this code chunk actually does.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 88% confidence

Finding

The documentation recommends running npx update-browserslist-db@latest, which fetches and executes the latest package version at runtime rather than a pinned, reviewed version. In a skill meant to guide agents through developer workflows, this increases supply-chain risk because a compromised or unexpected upstream release could be executed automatically in CI or on a developer machine.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This shell script executes package-manager install commands that will write to the user's project files, such as dependency manifests and lockfiles. Although it logs the commands, it does not prompt for confirmation or clearly disclose that it will modify the current workspace before making those changes.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.