saizeriya

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:59 AM UTC
• Version: 1.0.1

Overview

The skill matches its Saizeriya ordering purpose, but it asks the agent to run changing third-party npm packages directly, including an auto-accepted QR scanner, so users should review the runtime trust risk before installing.

Install only if you are comfortable letting the agent run these npm packages with your local agent permissions. Prefer a reviewed, pinned, preinstalled saizeriya.js and QR scanner, run them in a restricted environment, and carefully confirm any command that places an order, changes a cart, calls staff, or exposes account/receipt details.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:23

Finding

Unpinned Third-Party Packages Are Downloaded and Executed

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:23-27 and SKILL.md:50-55
Vulnerability Type: Unpinned package-runner dependency execution
Risk Level: Medium

Vulnerable Code

SKILL.md:23-27:

bash

npx saizeriya.js help
bunx saizeriya.js help

SKILL.md:50-55:

bash

npx -y qr-scanner-cli /path/to/qr-photo.jpg --clear

Then use the returned URL as the <qrurl> argument when starting a session:

bash

npx saizeriya.js start <name> <qrurl> [--people <count>]

Technical Analysis

The skill directs the agent to invoke saizeriya.js and qr-scanner-cli through package runners without pinning either dependency to a reviewed version or integrity digest. When the packages are not already cached, npx or bunx can retrieve the current registry release and immediately execute its installation hooks and application code.

The -y option used with qr-scanner-cli suppresses the package installation confirmation, further reducing the opportunity to review the package and version before execution. Referencing an upstream GitHub repository in the surrounding instructions does not ensure that the package fetched from the registry corresponds to a particular reviewed commit or artifact.

This is a supply-chain weakness rather than evidence that the currently published packages are malicious. The effective code executed by the skill can nevertheless change after the skill itself has been audited.

Attack Path

1. An attacker compromises the registry account, release pipeline, or another distribution component associated with one of the named packages.
2. The attacker publishes a malicious or compromised package version under the package name used by the skill.
3. A user asks the agent to operate the ordering CLI or decode a QR image.
4. The agent follows the skill and invokes the unversioned npx or bunx command.
5. The package runner downloads ...[truncated 891 chars]

Remediation

View remediation

Remediation Suggestions

• Pin every executed package to an explicitly reviewed version, such as npx saizeriya.js@X.Y.Z, rather than resolving the latest registry release.
• Maintain a lockfile containing integrity hashes and install dependencies through a reproducible, locked workflow.
• Verify package ownership, provenance, signatures, and the correspondence between the registry artifact and the intended source repository.
• Remove -y where practical so unexpected downloads are not accepted automatically.
• Prefer preinstalling reviewed packages in a controlled environment instead of downloading executable code during skill operation.
• Run the CLI in a sandbox with restricted filesystem access, a minimal environment, and network access limited to required service endpoints.
• Establish a dependency-update process in which new versions are reviewed and tested before changing the pinned version or integrity data.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (9)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The skill instructs the agent to execute npx saizeriya.js without pinning a specific version or integrity. npx resolves and runs the latest published package at execution time, so a compromised maintainer account, malicious new release, dependency hijack, or typo-squat scenario could lead to arbitrary code execution on the agent host.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

This command example uses unpinned npx saizeriya.js for a session-start flow. Because the skill is specifically designed to have the agent run the command, an attacker who can influence the npm package or its dependencies could obtain code execution in the agent environment before any Saizeriya-specific logic occurs.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The skill directs use of npx saizeriya.js use <name> without version pinning. Dynamic execution of an unpinned npm package is a supply-chain risk and can result in arbitrary command execution if the package or one of its transient dependencies is malicious or compromised.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

Using npx saizeriya.js list without a fixed version allows the executed code to change over time. In an agent skill, this is especially dangerous because the agent may automatically follow the instruction and execute attacker-controlled code if the upstream package becomes compromised.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The unpinned npx saizeriya.js rm <name> invocation inherits the same runtime package-fetch risk as the other examples. Because npx may install and run the latest code from the registry, any compromise upstream can translate into arbitrary code execution on the system running the skill.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

npx -y qr-scanner-cli is also unpinned and additionally uses -y, reducing friction for automatic installation and execution. This creates a direct supply-chain execution path from the skill instructions, allowing arbitrary code execution if the package or its dependencies are malicious, compromised, or replaced.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

This start example again instructs runtime execution of an unpinned npm package. Since the skill is operational and user-facing, the context makes the risk more concrete: the agent is expected to actually run these commands, so registry compromise can directly lead to host compromise.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The read-only orientation command npx saizeriya.js list is still unsafe when unpinned because the primary risk is code execution during package resolution and startup, not the logical effect of the CLI subcommand. Even ostensibly harmless subcommands can execute arbitrary malicious install/runtime hooks.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The npx saizeriya.js use <name> example remains a true supply-chain vulnerability despite being a read-oriented workflow step. The danger comes from executing untrusted latest-package code, which can perform arbitrary actions before handling the requested session operation.

Content

No source excerpt is available for this finding.