Security audit

Find Skills - Universal Discovery

Security checks for vulnerabilities and agentic risk

Overview

This skill is a marketplace installer that matches its purpose, but it encourages broad activation and unpinned third-party installs without enough user control or trust checks.

Review this carefully before installing. Use it only when you explicitly want skill discovery or installation, prefer pinned and reviewed SkillKit versions, inspect any target repository first, and require confirmation before installing skills that can affect future agent behavior.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:24
Finding: Unpinned Third-Party CLI Execution and Unverified Skill Installation
Content: View full analysis
# Install from GitHub npx skillkit@latest install # Browse TUI marketplace npx skillkit@latest marketplace # List installed skills npx skillkit@latest list # Get recommendations based on your project npx skillkit@latest recommend ``` The Skill also provides direct installation commands for multiple external repositories: ```markdown | Source | Install | |--------|---------| | Anthropic | `npx skillkit@latest install anthropics/skills` | | Vercel | `npx skillkit@latest install vercel-labs/agent-skills` | | Expo | `npx skillkit@latest install expo/skills` | | Remotion | `npx skillkit@latest install remotion-dev/skills` | | Supabase | `npx skillkit@latest install supabase/agent-skills` | | Stripe | `npx skillkit@latest install stripe/ai` | ``` ### Technical Analysis Every documented operation invokes `skillkit@latest` through `npx`. The `@latest` tag is mutable and resolves at execution time, so the downloaded package may differ from the package that existed when this Skill was reviewed. The project does not pin an exact package version, provide an integrity hash, use a lockfile, or include the executed CLI code in the audited artifact. The CLI is also instructed to install Skill content using an `owner/repo` value. This value may originate from marketplace search results or user input, and the instructions do not require repository ownership verification, immutable commit pinning, content inspection, or confirmation before activation. This creates a supply-chain trust boundary outside the audited project. Compromise of the npm package, its publisher account, a ...[truncated 1594 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (40)

Vague Triggers

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The activation condition “how do I do X” is far too broad and can match ordinary requests for guidance that have nothing to do with skill discovery. In this skill, over-broad activation is especially dangerous because it can redirect benign conversations into searching for and installing third-party skills, increasing exposure to supply-chain and prompt-injection risks without clear user intent.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 98% confidence
Finding: The README instructs users to run npx skillkit@latest, which fetches and executes the latest package version at runtime rather than a reviewed, immutable release. Because this skill is specifically about discovering and installing additional skills, it expands the supply-chain attack surface: a compromised package publish or malicious update could immediately execute code on the user's machine.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 98% confidence
Finding: Using npx skillkit@latest marketplace causes users to execute whatever version is current in the registry at the time of use, with no guarantee it matches a tested release. In a marketplace-browsing skill, this is especially risky because the tool is a trust gateway to further third-party content and could be abused to present or install malicious skills.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The README promotes installing skills directly from GitHub but provides no warning that this introduces untrusted third-party code into the agent environment. In this context, the omission is particularly dangerous because the skill's core purpose is to help users discover and add extensions from many sources, making social engineering and supply-chain compromise more likely.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 99% confidence
Finding: The command npx skillkit@latest install <owner/repo> combines two risky behaviors: executing an unpinned package and using it to install third-party code from GitHub. If either the CLI package or the referenced repository is malicious or compromised, this can lead to arbitrary code execution or persistent compromise of the agent environment.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 97% confidence
Finding: npx skillkit@latest recommend still executes an unpinned remote package, exposing users to supply-chain risk even if the command only appears to generate recommendations. Since recommendations may influence later installations, compromise here could steer users toward malicious skills or exfiltrate project metadata used for recommendation logic.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The front-matter description says the skill should be used when users want to find, browse, or install new skills and broadly when they need to extend capabilities across many domains. This broad trigger surface can cause the agent to invoke a marketplace/install skill in contexts where the user merely wants advice, unnecessarily steering the session toward execution of third-party tooling and code acquisition.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Triggering on a broad domain mention like testing, deployment, design, or security is vague and likely to misfire during normal conversation. In context, misfires are risky because they can prompt the agent to fetch external marketplace results or recommend installations even when the user only wanted conceptual assistance.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 96% confidence
Finding: The skill repeatedly instructs use of npx skillkit@latest, which executes the newest published package version at run time rather than a reviewed, immutable release. In a skill whose core purpose is discovering and installing third-party extensions, this creates a supply-chain risk: a compromised npm package or malicious update could execute arbitrary code on the host when the command is run.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 96% confidence
Finding: Using npx skillkit@latest install <owner/repo> causes dynamic execution of whatever package version is current at the time of use. Because the command directly performs installation of external skills, a malicious or hijacked upstream package could gain immediate code execution and then pull further untrusted content.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 96% confidence
Finding: The TUI marketplace command relies on npx skillkit@latest, so every invocation trusts the latest npm publication rather than a fixed artifact. This is dangerous because marketplace browsing is framed as routine usage, increasing chances that users execute unreviewed code without realizing they are accepting a supply-chain dependency.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 96% confidence
Finding: Listing installed skills via npx skillkit@latest list still triggers execution of the latest package from npm, so even read-only looking operations can run attacker-controlled code if the package is compromised. Users may underestimate the risk because the command appears informational rather than install-related.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 96% confidence
Finding: The recommendation command executes an unpinned CLI and may inspect the local project to generate suggestions. Combined with @latest, this raises the risk that a compromised package could exfiltrate repository data or environment details while masquerading as a benign recommendation feature.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The install instruction for anthropics/skills is delivered through unpinned npx skillkit@latest, again trusting mutable upstream code. Since this command installs additional skills, compromise of the CLI can cascade into broader system changes and persistence through installed extensions.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The Vercel install example uses a mutable package reference and therefore inherits the same arbitrary-code-execution risk from npm. In this file, repeated examples normalize unsafe execution patterns, making accidental insecure use more likely.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The Expo install example again depends on @latest, which is not an immutable target. Given the skill’s purpose of extending agent capabilities, any compromise can lead to execution of code from both the CLI and the fetched skill source.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The Remotion install example presents dynamic package execution as standard practice. This is dangerous because users are being guided to run package-manager-mediated code from a mutable upstream package in order to install more code from external repositories.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The Supabase example uses an unpinned executable package, preserving the same supply-chain issue. The risk is amplified by the skill’s role as a marketplace/discovery tool, because it encourages repeated execution against many external sources.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The Stripe install example continues the unsafe pattern of executing the newest package publication. Because the commands are copy-pastable and appear authoritative, they materially increase the chance of users running compromised code.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 96% confidence
Finding: The search example npx skillkit@latest find "react testing" uses an unpinned executable dependency. Even search-only operations can execute arbitrary code if the package is hijacked, and the skill’s discovery context makes such commands likely to be run frequently.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 96% confidence
Finding: This search example dynamically executes the latest SkillKit release, exposing the host to arbitrary code if upstream is compromised. The benign appearance of a search operation may lower user caution, increasing practical exploitability.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 96% confidence
Finding: The security audit search example is particularly concerning because security-conscious users may trust it more, yet it still executes mutable upstream code. An attacker could target such workflows to gain access to sensitive codebases under the guise of a tooling recommendation.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 96% confidence
Finding: The example install command for arbitrary <owner/repo> is executed through npx skillkit@latest, combining unpinned CLI execution with third-party skill installation. This compound trust chain significantly increases the chance of remote code execution or persistence through malicious skills.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill instructs the agent to install third-party skills for the user, including non-interactive installs, but provides no warning that skills are executable, may change agent behavior, and can affect the local system. In a marketplace/discovery skill, omission of trust and system-impact warnings materially increases the chance that users will authorize unsafe third-party code from arbitrary repositories.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 96% confidence
Finding: Installing a specific skill non-interactively via an unpinned CLI is dangerous because it removes friction and encourages automated execution of mutable code paths. In automation contexts, compromise could silently affect many environments before detection.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.