Snipgrapher - generate images from code snippets

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:40 PM UTC
• Version: 0.1.0

Overview

The skill is mostly coherent for generating snippet images, but it tells agents to run an unpinned npm package with automatic confirmation, so users should review it before installing.

Install only if you are comfortable with an agent running snipgrapher from npm. Prefer pinning an exact reviewed package version or installing it as a locked project dependency, and review any config changes before they are written.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: rules/setup-and-configuration.md:18

Finding

Unpinned npm Package Is Automatically Downloaded and Executed

Content

View full analysis

Vulnerability Details

File Locations:

• rules/setup-and-configuration.md, lines 18-20
• rules/rendering-workflows.md, line 77

Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable code snippets:

From rules/setup-and-configuration.md, lines 18-20:

bash

npx --yes snipgrapher doctor

From rules/rendering-workflows.md, line 77:

text

5. If `snipgrapher` is unavailable, fall back to npm (`npx --yes snipgrapher ...`).

Technical Analysis

The documented fallback uses npx --yes to resolve, download, and execute snipgrapher from the configured npm registry. The command does not specify an exact package version, integrity hash, lockfile, or verified package provenance. The --yes option also suppresses the normal installation confirmation.

Consequently, the code that executes can change after this Skill has been reviewed. The effective package version depends on npm registry state and package resolution at invocation time. If the package account, release process, registry response, or local npm registry configuration is compromised, an attacker-controlled package version could execute with the privileges of the user or Agent running the command.

Attack Path

1. An attacker compromises the npm package, its publisher account, the configured package registry, or another relevant supply-chain component.
2. The attacker publishes or serves a malicious release under the expected snipgrapher package name.
3. The local snipgrapher executable is unavailable, causing the documented npm fallback to be selected.
4. The Agent runs npx --yes snipgrapher ... without an exact version or integrity constraint.
5. npx downloads and executes the attacker-controlled package without requesting installation confirmation.
6. Malicious package lifecycle logic or CLI code runs under the invoking account and can access resources available to that account.

Impact Assessment

Successful exploitation can pr ...[truncated 567 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the dependency to an exact reviewed version:

   bash

   npx --yes snipgrapher@<exact-reviewed-version> doctor
   

2. Prefer installing the package as a project dependency with an exact version and committing the generated lockfile.

3. In automated workflows, invoke the audited local installation with npx --no-install snipgrapher ... so execution fails rather than downloading an unexpected release.

4. Verify package provenance, publisher identity, release signatures or attestations, and registry integrity before approving a version.

5. Use lockfile integrity metadata and a trusted, access-controlled npm registry or package proxy.

6. Run rendering in a least-privileged sandbox with restricted filesystem, credential, environment-variable, and network access.

7. Update both documented fallback locations so they cannot silently resolve an unreviewed latest release.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The fallback instruction npx --yes snipgrapher ... executes a package from the registry without pinning a version, which can pull in a newly published or compromised release at runtime. In an agent skill context, this increases supply-chain risk because the assistant may automatically run whatever code is currently served under that package name.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The instruction uses npx --yes snipgrapher without pinning an exact package version, so execution will resolve whatever version is current in the registry at runtime. This creates a supply-chain risk: a compromised latest release, dependency hijack, or unexpected breaking change could cause unreviewed code to run on the user's machine during setup.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The guidance to "create/update snipgrapher.config.* first" encourages modifying user files without any safety check, confirmation, or warning about overwriting existing configuration. In an agent setting, this can lead to unintended file changes, clobbered user configuration, or persistence of settings the user did not explicitly approve.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.