Onimi Pages Creator

• Outcome: Pass
• Latest audit: Sep 13, 2026 · 4:40 AM UTC
• Version: 0.1.0

Overview

This skill is a coherent local HTML page creator, with a practical caution to prefer verified or pinned installation routes over the mutable npm latest command.

Install from ClawHub or the verified direct-download flow when possible, and be cautious with the npm @latest command because it executes whatever package version is current at install time. Expect the skill to create local HTML files, run its local validator, and only publish or update when you explicitly authorize those actions.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: references/installation.md:9
• Finding: Mutable npm Package Version Is Downloaded and Executed During Installation## Vulnerability Details **File Location**: `references/installation.md`, lines 9–14; mirrored in `references/installation.zh-CN.md`, lines 9–13 **Vulnerability Type**: Unsafe execution of an unpinned third-party package **Risk Level**: Medium **Vulnerable Code:** ```markdown Use npm's `latest` release only after the npm channel is marked available in the [stable manifest](https://downloads.onimi.ai/skills/manifest.json). Node.js 20 or later is required. ```sh npx --registry=https://registry.npmjs.org onimi-pages-creator@latest install --agent codex ``` ``` ### Technical Analysis The installation command instructs users to download and execute the mutable npm `latest` release through `npx`. Although the documentation requires the npm channel to be marked available in a stable manifest, the command does not pin the package to the exact version identified by that manifest or independently verify package integrity or provenance. As a result, the code reviewed in this repository is not necessarily the code executed by this command. The effective installer can change whenever the npm `latest` tag is updated. A compromise of the npm publisher account, package, release process, or mutable distribution tag could therefore substitute attacker-controlled installer code. ### Attack Path 1. An attacker compromises the npm package publisher account, publication pipeline, or another mechanism capable of changing the package associated with `onimi-pages-creator@latest`. 2. The attacker publishes a malicious release and assigns it to the `latest` tag. 3. The stable manifest may continue to indicate that npm is an available channel because the installation command does not bind execution to the manifest's exact version or archive digest. 4. A user follows the documented command. 5. `npx` downloads and executes the malicious package before the user can inspect its installer behavior. 6. The malicious installer operates with the per ...[truncated 723 chars]
• Remediation: ## Remediation Suggestions 1. Replace `@latest` with an exact, reviewed package version, such as `onimi-pages-creator@0.1.0`. 2. Ensure the exact npm version is obtained from the authenticated stable manifest rather than relying only on a channel-availability flag. 3. Publish and verify an integrity value for the npm package or tarball before execution. Where supported, require npm provenance attestations and validate the expected publisher and source repository. 4. Prefer the documented immutable archive workflow, which verifies both byte length and SHA-256, when equivalent integrity verification cannot be applied to `npx`. 5. Update both English and Chinese installation guides simultaneously so neither continues to recommend mutable package execution. 6. Consider separating package download from execution, allowing users or automation to validate the resolved version and integrity before invoking the installer.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (8)

Ae1

High

• Category: analysis-evasion

Content

from the loaded `SKILL.md` path, then run its validator by absolute path without changing the user's

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

from the loaded `SKILL.md` path, then run its validator by absolute path without changing the user's

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Self-Modification

High

• Category: Rogue Agent

Content

The direct-download
manager protects modified, missing, and additional local files, verifies the archive and fingerprints,
and keeps a backup for rollback. Installations from npm, ClawHub, or another host follow that channel's
own update behavior; do not promise one uniform self-update mechanism.

• Confidence: 90% confidence
• Finding: The skill includes self-update instructions that execute a manager script capable of modifying the installed skill. Even though the text says not to update automatically and requires explicit confirmation, embedding self-modification logic inside the skill increases supply-chain and integrity risk if the manager script, update channel, or installation metadata is compromised.

Memory Manipulation

High

• Category: Memory Poisoning

Content

editorial reading path, anchored evidence, and a print layout.
- Operational material such as runbooks, plans, and itineraries benefits from sequence, progress, and
  locally persistent or clearly temporary check state.
- Comparison and calculation tools need explicit inputs, immediate results, sane defaults, and a clear
  statement that sample figures are illustrative.
- Teaching and quiz pages need visible progress, reversible choices, keyboard-complete controls, and
  feedback that explains the result.

• Confidence: 80% confidence
• Finding: Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill directs the agent to use shell commands, resolve filesystem paths, and potentially perform network-related update checks, but it declares no explicit tool scope or permission boundaries. In an agent environment, this broad undeclared capability increases the risk of unexpected command execution, file access, or network activity beyond what a user would reasonably expect from a page-creation skill.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The description is broad enough to match many ordinary requests for websites, reports, dashboards, demos, and other artifacts, which can cause the skill to activate in situations the user did not specifically intend. Over-broad invocation increases the chance that powerful behaviors in the skill, including shell execution and publishing workflow transitions, are brought into scope unnecessarily.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: This language directs the agent to choose the output language automatically rather than offering or confirming a language preference with the user. That can violate language/locale policy where users must be given a choice instead of having language determined implicitly.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

dashboard upload path. Keep the finished local HTML usable either way.

When the user has explicitly authorized publication, continue through the installed publish workflow
without asking again for the same authorization. Never choose public visibility when the user's intent
is private or unclear.

## Check for updates

• Confidence: 75% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Static analysis

No suspicious patterns detected.