Security audit
Security checks for vulnerabilities and agentic risk
The skill fits its caffeine-tracking purpose, with ordinary dependency risks from running an unpinned external package.
Use a reviewed, pinned package version and restrict execution to the intended log where practical. Drink history persists in ~/.gopromotional-mugday.json unless overridden. Treat caffeine and sleep estimates as approximate. This review verifies the skill instructions, not the externally downloaded implementation.
The drinks command uses an unpinned npm package, allowing the resolved version to change, while -y suppresses the installation confirmation. A compromised release could execute code with the agent's permissions; this is a CLI rather than an MCP server, but the supply-chain concern still applies.
The add command automatically runs an unpinned npm package, so routine drink logging can execute a release that has not been reviewed. If the package is compromised, its code is not restricted to updating the caffeine log and could access other data available to the agent.
This custom-drink example also runs the package without a version pin and automatically accepts installation. The quoted drink name and timestamp are not themselves suspicious, but a compromised package release could execute arbitrary code under the agent's account.
Although today appears to be a read-only reporting operation, npx still executes the unpinned package's code. A malicious or compromised release could therefore access credentials, modify files, or transmit accessible data rather than merely report caffeine intake.
The in-system calculation relies on executable code fetched through an unversioned package reference. The benign caffeine-tracking purpose does not constrain that code's permissions, so a compromised release could affect unrelated files or secrets.
The sleep-ready command automatically executes an unpinned npm package; its threshold argument does not mitigate the package supply-chain exposure. A compromised release could run arbitrary code with the agent's privileges, regardless of the intended sleep calculation.
The cups report repeats the same unpinned, automatically accepted package execution. Even though cup counting is low sensitivity, a compromised package would execute with the agent's broader permissions rather than permissions limited to counting cups.
No suspicious patterns detected.
