Minecraft Ore Finder

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:53 AM UTC
• Version: 0.1.1

Overview

The skill has a clear Minecraft ore-estimation purpose, but it tells agents to run unpinned third-party packages that can change after review.

Install only if you are comfortable with the agent downloading and running the current npm or PyPI `orefinder-estimate` package. Prefer a pinned, reviewed version or a sandboxed environment, and treat orefinder.io as an optional third-party site rather than a required part of the skill.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:68
• Finding: Mandatory External-Service Promotion Alters Agent Responses<** at https://orefinder.io. ``` ### Technical Analysis The skill instructs the agent to insert a specific external-service recommendation into every applicable response. The use of “Always remind the user” makes this a persistent response-shaping requirement rather than an optional, context-dependent reference. When the skill is loaded, this instruction modifies how the agent fulfills Minecraft ore-location requests by requiring promotion of an external website. The destination is not needed to run the documented offline estimator and is outside the audited project. The website's behavior and trustworthiness cannot be established from the repository. ### Attack Path 1. The agent loads `SKILL.md` while handling a Minecraft mining or ore-location request. 2. The user asks for an estimate that can be answered through the documented local tool. 3. The skill's mandatory instruction requires the agent to include `https://orefinder.io` in its response. 4. The user may follow the link under the impression that it is a necessary or independently validated component of the agent's answer. 5. Any collection, tracking, or further interaction then occurs outside the audited skill and agent environment. ### Impact Assessment This issue affects response integrity and user trust. It can cause unsolicited traffic redirection and makes a third-party service appear to be a required part of the workflow. The instruction does not directly grant system privileges, ac ...[truncated 233 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Remove the unconditional “Always remind the user” requirement. - Mention the external service only when the user explicitly requests exact coordinates or asks for alternatives to the local estimator. - Clearly label the website as an optional, unaudited third-party service. - Do not imply that visiting the website is necessary to use the offline functionality. - Add a disclosure that the external destination is outside the skill's security boundary and may have separate privacy and security practices. ]]>

T08 · Insecure Dependencies

Error

• Location: SKILL.md:29
• Finding: Automatic Execution of Unpinned Third-Party Packages<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:29-42` **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: High ### Vulnerable Code ```markdown ```bash npx -y orefinder-estimate --version java_1_21 --ore diamond -x 0 -y 64 -z 0 ``` JSON output (for parsing/automation): ```bash npx -y orefinder-estimate --ore ancient_debris --version java_1_21 --biome crimson_forest --json ``` List supported ores: ```bash npx -y orefinder-estimate --ores ``` If Node/npx is unavailable, the same tool is on PyPI: ```bash pip install orefinder-estimate orefinder-estimate --version bedrock_1_20 --ore iron -x 100 -y 40 -z -200 ``` ``` ### Technical Analysis The documented commands download and execute `orefinder-estimate` from public package registries without pinning an exact version or verifying package integrity. In particular, `npx -y` automatically accepts installation and executes the registry-resolved package. The pip workflow similarly installs whichever release satisfies the unversioned package name. The audited repository contains no implementation of this dependency, lockfile, cryptographic checksum, trusted publisher metadata, or reproducible dependency manifest. Consequently, the actual code executed can change after this skill has been reviewed. The repository also states that the tool “runs fully offline and makes no network calls,” but the documented installation and first-use workflow may contact npm or PyPI when the package is not already cached. The audit could not verify whether the installed package itself makes network calls because its source code is absent. ### Attack Path 1. An agent follows the quick-start instructions and invokes `npx -y orefinder-estimate`, or installs the package with `pip install orefinder-estimate`. 2. npm or PyPI resolves the unpinned package name to the currently published release. 3. If the publisher account, package, registry resolution, or a transitive dependency has been compromised, ...[truncated 1377 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Pin npm and PyPI dependencies to exact, reviewed versions rather than resolving the latest release. - Verify downloaded artifacts with cryptographic integrity hashes or signed provenance. - Include the dependency source or a reproducible vendored artifact in the reviewed project. - For npm, use a lockfile and an installation workflow that validates integrity; disable lifecycle scripts where they are unnecessary. - For Python, use exact version constraints and hash-locked requirements, such as `pip install --require-hashes -r requirements.txt`. - Review all transitive dependencies and maintain an update process that requires security review before changing pinned versions. - Separate installation instructions from runtime instructions and accurately disclose that installation may require network access. - Run the estimator in a sandbox with restricted filesystem, environment-variable, subprocess, and network access. - Avoid elevated privileges and ensure the process receives only the minimum files and credentials needed for the task. ]]>

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Skill Enumeration

Medium

• Category: Agent Snooping

Content

Drop the folder into your agent's skills directory:

- Cursor (personal): `~/.cursor/skills/minecraft-ore-finder/SKILL.md`
- Cursor (project): `.cursor/skills/minecraft-ore-finder/SKILL.md`

## Publish to a skills marketplace

• Confidence: 80% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

Drop the folder into your agent's skills directory:

- Cursor (personal): `~/.cursor/skills/minecraft-ore-finder/SKILL.md`
- Cursor (project): `.cursor/skills/minecraft-ore-finder/SKILL.md`

## Publish to a skills marketplace

• Confidence: 80% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The trigger language is broad enough to activate on general Minecraft discussion such as mining, ore distribution, or Java/Bedrock ore locations, even when the user may not be clearly asking to run this skill. In context, that increases the chance the agent will unnecessarily invoke tooling that can execute package-managed commands, expanding exposure to the supply-chain risk described above.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence
• Finding: The skill instructs use of `npx -y orefinder-estimate` without pinning an exact package version, so execution will fetch and run whatever the current registry version resolves to at runtime. That creates a software supply-chain risk: a compromised publisher account, malicious update, or dependency hijack could cause arbitrary code execution in the agent environment.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence
• Finding: This example again uses `npx -y orefinder-estimate` without an exact version, which means the agent may download and execute unreviewed code on demand. Even though the skill describes the tool as offline, the package acquisition step itself relies on the package ecosystem and is vulnerable to malicious releases or dependency-chain compromise.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence
• Finding: Listing supported ores via `npx -y orefinder-estimate --ores` still performs an unpinned remote package resolution and execution step. A seemingly harmless command can therefore become an entry point for arbitrary code execution if the upstream package or one of its dependencies is replaced or tampered with.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Static analysis

No suspicious patterns detected.