Security audit
Security checks for vulnerabilities and agentic risk
The instructions fit event planning, with ordinary software supply-chain risk from running an unpinned external package.
Running these commands may download and execute third-party software despite the phrase 'no install needed.' Prefer a reviewed, fixed package version and run it without access to unrelated secrets. This assessment covers the skill instructions, not a verified audit of the downloaded package.
The countdown command uses npx -y to fetch and execute an unpinned package, allowing a compromised future release to run with the agent's permissions without an installation confirmation. Although this is a CLI rather than an MCP server, the supply-chain risk remains real; the supplied content does not establish that the package is malicious.
The timeline command automatically executes an unpinned npm package, so its behavior can change without any modification to the skill. A compromised release could access files or credentials available to the agent; the ordinary event-planning purpose provides no need for those privileges.
The giveaways command uses the same unpinned, automatically accepted package execution mechanism, exposing the agent to malicious upstream updates. The numerical arguments are not themselves suspicious, but a simple quantity calculation does not require executing mutable third-party code with the agent's full permissions.
The order-by command can fetch and execute a changing package version through npx -y, creating the same supply-chain exposure as the other commands. Exploitation would require a malicious resolved package or dependency, but could result in arbitrary code execution under the agent's account.
No suspicious patterns detected.
