slopcheck

• Outcome: Review
• Latest audit: Sep 11, 2026 · 1:21 PM UTC
• Version: 0.1.2

Overview

The skill’s purpose is coherent, but its main usage examples run an unpinned npm CLI through npx, so users may execute code that was not part of the reviewed artifact.

Before installing or using this skill, prefer running a pinned and reviewed package version such as `slopcheck@0.1.2`, and use it in a constrained environment without unrelated secrets if scanning sensitive repositories or CI workspaces.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:27

Finding

Unpinned Third-Party npm Package Retrieval and Execution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 27–42
Vulnerability Type: Unpinned third-party dependency execution
Risk Level: Medium

Vulnerable Code

bash

# Scan specific files
npx slopcheck SKILL.md README.md

# Scan a directory recursively (.md, .yml, .yaml, .json, .cursorrules)
npx slopcheck .

# Scan with JSON output for programmatic use
npx slopcheck --json .

# Ignore known-good internal packages
npx slopcheck --ignore my-internal-pkg,another-known-pkg .

# Control registry check concurrency
npx slopcheck --concurrency 5 .

Technical Analysis

The documented commands invoke slopcheck through npx without specifying an exact package version or integrity constraint. If the package is not already available locally, npx can retrieve a release from the npm registry and execute its CLI code. The effective executable can therefore differ from the version reviewed when this Skill was published.

The project contains only SKILL.md; it does not include the package implementation, a lockfile, checksums, or provenance verification. Consequently, the behavior of the remotely resolved executable cannot be validated from the audited artifact. A compromised maintainer account, malicious package release, registry compromise, or future unsafe release could convert these otherwise legitimate-looking commands into arbitrary local code execution.

Attack Path

1. An attacker compromises the npm package, its publisher account, or another component of the package publication process.
2. The attacker publishes a malicious release under the existing slopcheck package name.
3. A user or agent follows one of the documented unversioned npx slopcheck commands.
4. npx resolves and downloads the mutable package release from the npm registry.
5. Package lifecycle behavior or the CLI entry point executes attacker-controlled code under the invoking user's account.
6. The malicious p ...[truncated 804 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the command to an exact, reviewed release rather than resolving the latest available version:

   bash

   npx --yes slopcheck@0.1.2 SKILL.md README.md
   npx --yes slopcheck@0.1.2 .
   

2. Verify the selected release's npm provenance, publisher identity, and integrity before recommending execution.

3. Prefer installing the reviewed version through a lockfile-backed development dependency and invoke it with npm exec --offline where practical.

4. Include or reference the reviewed source revision so users can compare the npm artifact against its source.

5. Run the tool with least privilege in an isolated environment without unrelated credentials or sensitive environment variables.

6. In CI, restrict outbound network access and use an approved package mirror or allowlist after the dependency has been reviewed.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (7)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The skill instructs users to execute npx slopcheck without pinning an exact package version. Because npx resolves and may download the latest package from the registry at execution time, a future malicious update or compromised publisher account could cause users to run unreviewed code.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

This example uses npx slopcheck . without an exact version, which means execution depends on whatever version is current in the npm registry when the command is run. That creates a supply-chain risk if the package is later hijacked, replaced, or updated with malicious behavior.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The documented npx slopcheck --json . invocation is not version-pinned, so it may fetch and run untrusted future code from npm. In a security-focused skill, this is especially risky because users are encouraged to run the tool on untrusted content, increasing the likelihood of routine execution.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

Using npx slopcheck --ignore ... . without a pinned version exposes users to registry-time package substitution or malicious updates. Since the command is presented as standard usage guidance, readers may copy-paste it directly and repeatedly, amplifying impact if the package supply chain is compromised.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

This command recommends npx slopcheck --concurrency 5 . without pinning the package version, so users could execute a future malicious release. Security tools are high-trust utilities, making unpinned ephemeral execution more dangerous because users may run them in sensitive repositories or CI environments.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.