Agent Sdd Bootstrap

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 10:38 AM UTC
• Version: 1.0.0

Overview

The skill is a disclosed OpenSpec/SDD bootstrap workflow, with a notable but purpose-aligned supply-chain caution around installing the OpenSpec CLI globally from npm.

Before installing, review the npm package version you intend to use, avoid running the global install with administrator privileges, commit or stage the project first, and inspect generated OpenSpec and agent skill/command files before relying on them.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:41

Finding

Unpinned Global Installation of a Mutable Third-Party Dependency

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:41, SKILL.md:215, and references/powershell.md:10-13
Vulnerability Type: Supply-chain exposure through an unpinned globally installed npm package
Risk Level: Medium

Vulnerable Code

SKILL.md:41:

bash

openspec --version &>/dev/null || npm install -g @fission-ai/openspec@latest

SKILL.md:215:

text

| `--tools` list does not contain the target tool | OpenSpec version is outdated | Run `npm update -g @fission-ai/openspec` and check again |

references/powershell.md:10-13:

powershell

if (-not (Get-Command openspec -ErrorAction SilentlyContinue)) {
  npm install -g @fission-ai/openspec@latest
}

Technical Analysis

The Skill directs the agent to install @fission-ai/openspec@latest globally or update the existing global package without pinning a reviewed version. The mutable latest tag can resolve to different package contents over time. No lockfile, expected integrity hash, provenance check, or signature verification is specified.

npm installations may execute package lifecycle scripts. A global installation also places the package and its executable in shared user-level or system-level npm locations, depending on the environment. After installation, the Skill invokes openspec init, which generates configuration, command, and Agent skill files. It may subsequently copy those generated files into other Agent CLI configuration directories.

This does not establish that the named package is malicious. The vulnerability is that future package contents are trusted and executed without reproducible version or integrity controls, increasing exposure to an upstream account compromise, malicious release, or unexpected behavior in a newly published version.

Attack Path

1. An attacker compromises the upstream package, maintainer credentials, publication process, or a future package release.
2. The compromis ...[truncated 1282 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace @latest with an exact, reviewed version, for example:

   bash

   npm install -g @fission-ai/openspec@X.Y.Z
   

2. Define the approved version once and use the same exact version in both Bash and PowerShell instructions.
3. Remove or replace the unbounded npm update -g recommendation with installation of a specifically approved version.
4. Verify package provenance and expected integrity before installation. Record the approved package version, tarball integrity hash, and review date in the Skill.
5. Prefer a project-local or isolated installation over a global installation, such as a locked development dependency executed through an appropriate package runner.
6. Where compatible, suppress lifecycle scripts during installation and explicitly enable only scripts that have been reviewed.
7. Run package installation without administrative privileges and use a dedicated, least-privileged environment.
8. Review all files generated by openspec init before loading or copying them into other Agent CLI directories.
9. Commit or stage the repository before initialization and inspect the resulting diff, including generated Agent instructions, before accepting the changes.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This file consistently requires Chinese-language interaction in its natural-language description and operating instructions, but does not indicate that language selection is optional or user-configurable. That can violate a language/locale policy when the organization expects skills not to force a specific language without user opt-in.

Content

No source excerpt is available for this finding.