T08 · Insecure Dependencies
Error
- Location
SKILL.md:25- Finding
Unpinned Global Installation of a Mutable npm Package
- Content
View full analysis
- Remediation
View remediation
Security audit
g1geo
Security checks for vulnerabilities and agentic risk
Overview
The skill is coherent for a GEO content and publishing CLI, but it asks agents to auto-install a mutable global CLI and treat that CLI's runtime guide as authoritative.
Review this skill before installing. Only use it if you trust the @g1geo/cli publisher and are comfortable with a global npm executable, account-level CLI access, and publishing workflows. Require explicit approval for installs, updates, authentication, and publication, and prefer a pinned, reviewed CLI version.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:33- Finding
Mutable CLI Output Is Treated as Authoritative Agent Instruction
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (4)
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The instruction to invoke the skill whenever the user mentions g1geo-related terms or broad phrases like 'AI生成优化' is ambiguous and may activate on ordinary discussion rather than a clear request to operate the tool. In context, this is more dangerous because the same skill also directs installation, authentication, and operational execution, so accidental activation can cascade into impactful actions.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill tells the agent not to ask for confirmation and to directly attempt a global install/update when the CLI is unavailable, which bypasses an important user-awareness checkpoint for system changes. In this skill's context, that instruction is especially risky because the tool can later authenticate, access products, and distribute content, so silent installation expands both execution and account-scope exposure.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The instruction to invoke the skill whenever the user mentions g1geo-related terms or broad phrases like 'AI生成优化' is ambiguous and may activate on ordinary discussion rather than a clear request to operate the tool. In context, this is more dangerous because the same skill also directs installation, authentication, and operational execution, so accidental activation can cascade into impactful actions.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill explicitly instructs the agent to run a global npm install/update of @g1geo/cli and to do so automatically if the CLI is missing or outdated. This is dangerous because it causes a system-wide modification and executes code fetched from the network without clear user consent, version pinning, or trust validation, which increases supply-chain and host-integrity risk.
- Content
Static analysis
No suspicious patterns detected.