Onimi Pages Publish

• Outcome: Pass
• Latest audit: Sep 14, 2026 · 6:57 PM UTC
• Version: 0.2.1

Overview

This skill is a disclosed HTML publishing integration with user-controlled OAuth and update behavior, though users should prefer verified or pinned installation paths.

Install only from a channel you trust. For the lowest supply-chain risk, use the direct-download path and verify the manifest size and SHA-256, or use pinned marketplace tooling where appropriate. Do not approve OAuth scopes you do not expect, and remember that publishing writes an externally accessible page depending on project visibility.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: references/installation.md:12
• Finding: Installation Instructions Execute Mutable or Unverified npm Packages## Vulnerability Details **File Location**: `references/installation.md:12-19`, `references/installation.md:52`, `references/installation.md:65`, `references/installation.zh-CN.md:12-25`, `references/installation.zh-CN.md:53`, and `references/installation.zh-CN.md:65` **Vulnerability Type**: Supply-chain exposure through remotely retrieved executable packages **Risk Level**: Medium ### Vulnerable Code English installation guide: ```sh npx --registry=https://registry.npmjs.org onimi-pages-publish@latest install --agent codex ``` ```sh npx --registry=https://registry.npmjs.org onimi-pages-publish@latest --help ``` ```sh npx --registry=https://registry.npmjs.org clawhub@0.23.3 install @mariohazy/onimi-pages-publish ``` ```sh npx --registry=https://registry.npmjs.org skills@1.5.26 add zlch-oceanai/onimi-pages-publish --skill onimi-pages-publish --global ``` Equivalent commands in the Chinese installation guide: ```sh npx --registry=https://registry.npmjs.org onimi-pages-publish@latest install --agent codex --lang zh-CN ``` ```sh npx --registry=https://registry.npmjs.org onimi-pages-publish@latest --help ``` ```sh npx --registry=https://registry.npmjs.org clawhub@0.23.3 install @mariohazy/onimi-pages-publish ``` ```sh npx --registry=https://registry.npmjs.org skills@1.5.26 add zlch-oceanai/onimi-pages-publish --skill onimi-pages-publish --global ``` ### Technical Analysis The installation procedure directs users to retrieve and immediately execute npm package code through `npx`. The primary package is selected using the mutable `@latest` tag, so the code executed by the same documented command can change after this Skill has been audited. Although the documentation asks users to consult a distribution manifest before using a registry channel, that availability check does not cryptographically bind the npm artifact to an expected package digest. The `clawhub` and `skills` command-line pack ...[truncated 1910 chars]
• Remediation: ## Remediation Suggestions 1. Replace `onimi-pages-publish@latest` with an exact, immutable version in all executable examples. 2. Publish an expected npm integrity value or cryptographic digest through a separately authenticated channel and require verification before execution. 3. Cryptographically bind the npm package version and digest in the stable manifest rather than using the manifest only as an availability indicator. 4. Prefer downloading a versioned artifact, verifying its byte size and SHA-256 digest, and then running a locally reviewed installer. 5. Pin all transitive dependencies and use reproducible builds and lockfiles in the published npm packages. 6. Protect publisher accounts with phishing-resistant multi-factor authentication, provenance attestations, restricted automation tokens, and mandatory release review. 7. Recommend installation under an unprivileged user and explicitly warn users not to invoke the installer with `sudo` or administrator privileges. 8. Apply the same immutable-version and integrity-verification requirements consistently to both installation guides.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Credential Access

High

• Category: Privilege Escalation

Content

# Onimi Pages Publish

Use the Onimi Pages Remote MCP tools. Never ask the user to paste an API key, access token, authorization code, or refresh token into chat.

Follow the user's conversation language for progress, errors, and the final result: answer in Chinese
for a Chinese conversation and in English for an English conversation unless the user asks otherwise.

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Ae1

High

• Category: analysis-evasion

Content

this `SKILL.md`; if that receipt is absent, do not run the manager. Use npm, GitHub,

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 77% confidence
• Finding: The skill performs sensitive actions involving remote publishing, OAuth-mediated network access, and potentially local command execution for update management, yet it declares no explicit tool scope or permission boundaries. In hosts that rely on manifest-declared restrictions, this can cause overbroad capability exposure and weakens reviewability of what the skill is allowed to access.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

# Onimi Pages Publish

Use the Onimi Pages Remote MCP tools. Never ask the user to paste an API key, access token, authorization code, or refresh token into chat.

Follow the user's conversation language for progress, errors, and the final result: answer in Chinese
for a Chinese conversation and in English for an English conversation unless the user asks otherwise.

• Confidence: 80% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: The manifest describes this skill as publishing one HTML page through the Onimi Pages Remote MCP, but this file implements a full skill manager with status checking, network-based update retrieval, archive verification, backup creation, and atomic replacement of the installed skill. Those operations are not part of publishing HTML and represent materially broader behavior than the manifest claims.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: A skill intended to upload or publish HTML would reasonably contact the publishing service, but this code instead contacts a distribution server, downloads ZIP archives, validates them, and rewrites the local installation directory. That is a software update mechanism, not an obvious requirement of HTML page publishing.

Static analysis

No suspicious patterns detected.