Shared Workspace

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 9:24 PM UTC
• Version: 0.1.2

Overview

The skill is a coherent shared-workspace helper, with disclosed but real supply-chain and credential-scope risks from unpinned global npm tools and optional GitHub/BountyHub integrations.

Install only if you trust the npm packages and their publisher. Prefer pinned versions or an isolated environment, and provide only short-lived, least-privilege GitHub tokens limited to the repositories and actions you actually need.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:13

Finding

Unpinned Third-Party npm Packages Are Installed Globally and Executed

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 13–20 and 90–94
Vulnerability Type: Unpinned and globally installed third-party dependencies
Risk Level: Medium

Vulnerable Code

Lines 13–20:

markdown

Install the MCP server (npm):
```bash
npm install -g agent-shared-workspace

Run the MCP server (stdio):

bash

shared-workspace-mcp

Lines 90–94:

markdown

### BountyHub (escrowed milestones)
Use `@h1dr4/bountyhub-agent` for paid deliverables:
```bash
npm install -g @h1dr4/bountyhub-agent

text

### Technical Analysis

The skill instructs users to install third-party npm packages globally without pinning reviewed versions or verifying package integrity. The primary package is subsequently executed as an MCP server. npm installation can also execute package lifecycle scripts, meaning code execution may occur during installation before the documented command is launched.

Because no exact version, cryptographic integrity value, lockfile, or reproducible installation mechanism is specified, the code installed by these commands can change after the skill has been audited. A compromised maintainer account, malicious future release, dependency compromise, or package-registry attack could therefore introduce arbitrary code.

The documentation also describes supplying `GITHUB_TOKEN` or `SHARED_GH_TOKEN` to enable GitHub operations. If such credentials are present in the MCP process environment, a compromised package could attempt to access them. The recommendation to use a least-privilege token reduces potential impact but does not eliminate the underlying supply-chain exposure.

### Attack Path

1. An attacker compromises the npm package, a transitive dependency, a maintainer account, or a future package release.
2. The attacker publishes a malicious version under the existing package name.
3. A user follows the skill and runs the unversioned global installation command
...[truncated 1274 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin every package to a specific reviewed version, for example:

   bash

   npm install --global agent-shared-workspace@<reviewed-version>
   npm install --global @h1dr4/bountyhub-agent@<reviewed-version>
   

2. Publish expected package integrity hashes or use a lockfile-backed installation process that verifies package contents.

3. Avoid global installation where possible. Run the package in a dedicated container, restricted user account, or isolated project environment.

4. Review package lifecycle scripts and transitive dependencies before recommending a release.

5. Use npm settings that disable lifecycle scripts when compatible with the package, then explicitly run only reviewed setup steps.

6. Document the exact trusted publisher, repository, package version, and release commit so users can verify provenance.

7. Supply GitHub credentials only to verified builds. Use short-lived, repository-scoped, read-only tokens unless write access is explicitly required.

8. Restrict the MCP process's filesystem and network access to the minimum necessary workspace and endpoints.

9. Establish a controlled update process in which new package versions are reviewed before the pinned version in SKILL.md is changed.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The activation guidance is broadly phrased around common collaboration goals like sharing work, avoiding duplication, and collaborating across repositories. In agent systems that auto-select skills from natural-language intent, this can cause the skill to trigger in many ordinary requests, increasing exposure to its external-repo, GitHub, and workspace-attachment capabilities without the user explicitly asking for them.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.