Paprika

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 4:38 AM UTC
• Version: 0.1.0

Overview

This skill is a straightforward Paprika Recipe Manager CLI guide, with ordinary setup risks around installing a third-party npm package and handling account credentials.

Before installing, verify that paprika-recipe-cli is the package you intend to trust, avoid running npm with administrator privileges, prefer the interactive paprika auth flow, and do not commit or leave PAPRIKA_EMAIL or PAPRIKA_PASSWORD in shell profiles, logs, or shared environments.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:16

Finding

Unpinned and Unverified Global npm Package Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 16
Vulnerability Type: Third-party software supply-chain risk
Risk Level: Medium

Complete Code Snippet:

bash

npm install -g paprika-recipe-cli

Technical Analysis

The installation instructions direct users to install paprika-recipe-cli globally from the npm registry without pinning a reviewed version or supplying package-integrity information. The documentation also provides no evidence that the package is published or maintained by Paprika's official vendor.

Consequently, npm resolves whichever package version is current when the command is run. If the package, its publisher account, or one of its transitive dependencies is compromised, package-controlled installation lifecycle scripts may execute during installation. The global installation mode increases exposure by placing the package in the user's global npm environment and making its executable broadly available.

The project contains only documentation, and the audit found no evidence that the package is currently malicious. This finding concerns the unsafe dependency acquisition process and its exposure to future package compromise, namespace takeover, or malicious releases.

Attack Path

1. An attacker compromises the npm publisher account, the package itself, or a transitive dependency, or otherwise gains control of a release delivered under the referenced package name.
2. The attacker publishes a release containing malicious package code or an npm lifecycle script.
3. A user follows the documented npm install -g paprika-recipe-cli instruction.
4. npm retrieves the attacker-controlled release because no reviewed version or integrity value is specified.
5. Package installation code executes with the privileges of the account running npm and the malicious CLI becomes available through the user's global npm executable path.
6. Subsequent use of the CLI may expose Paprika cred ...[truncated 901 chars]

Remediation

View remediation

Remediation Suggestions

• Verify that paprika-recipe-cli is published and maintained by a trusted party, and document the verified publisher and official package source.
• Pin the installation instruction to a specific reviewed version rather than implicitly installing the latest release.
• Publish and verify package integrity metadata or a cryptographic checksum through a trusted channel.
• Prefer a project-local dependency with a lockfile over a global installation so that dependency versions and integrity values are reproducible.
• Review the package and its transitive dependencies, including npm lifecycle scripts, before recommending it.
• Where package functionality permits, install with lifecycle scripts disabled and invoke a locally pinned binary.
• Advise users not to run npm installation with administrative privileges.
• Avoid long-lived plaintext password environment variables where the CLI supports a more secure credential store or token-based authentication.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill documentation instructs users to place Paprika account credentials directly into environment variables without any warning about secret handling, shell history exposure, process/environment leakage, or use of a safer secret store. While this is common setup guidance, it can lead to credential disclosure on shared systems, in logs, shell profiles, or debugging output, especially when copied into persistent configuration files.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.