T08 · Insecure Dependencies
Warning
- Location
SKILL.md:12- Finding
Unpinned Third-Party Packages Executed Through npx
- Content
View full analysis
- Remediation
View remediation
Security audit
Writing Proofreading
Security checks for vulnerabilities and agentic risk
Overview
This is a coherent Chinese article proofreading skill with disclosed optional linting commands, but users should avoid running the unpinned npx setup and autofix commands without review.
Install this if you want a Chinese article proofreading workflow. Before running its Markdown lint steps, prefer a pinned or lockfile-managed markdownlint-cli2 version, review any --fix changes, and treat the external `npx skills add niracler/skill` setup command as code from outside this artifact.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (11)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The description lists triggers such as 「检查一下」, 「帮我改改」, and 「看看文章」, which are common conversational phrases and not narrowly scoped to this specific skill. Without exclusions or tighter context, these phrases may overlap with ordinary user requests and activate the skill unintentionally.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The skill is described as helping refine Chinese articles and the guidance throughout the file is written as a Chinese-only workflow, but there is no opt-in or explicit statement that the skill is limited to Chinese content for a justified regional or compliance reason. This can violate language/locale policy when users have not chosen that constraint.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 94% confidence
- Finding
The skill recommends executing
npx markdownlint-cli2without pinning a specific package version.npxmay fetch the latest package at runtime, which creates a supply-chain risk: a compromised upstream release or unexpected breaking change could cause unreviewed code execution on the user's machine.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 92% confidence
- Finding
The instruction
npx skills add niracler/skillreferences an unpinned package/tool invocation that may download and run code dynamically. This exposes users to the same supply-chain and integrity risks as other unpinnednpxusage, especially because it appears in setup guidance that users may execute verbatim.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 95% confidence
- Finding
This command again instructs users to run
npx markdownlint-cli2without version pinning during the review workflow. Because the command is positioned as routine operational guidance, it increases the chance that users will execute transient, unreviewed package code directly from the registry.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 95% confidence
- Finding
The
--fixvariant has the same unpinnednpxrisk, with additional integrity concerns because it modifies files automatically after fetching package code at runtime. If an upstream package were compromised, the attack could both execute code and alter repository contents.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This markdown file is entirely framed as a prescriptive Chinese writing standard, using directive language such as '中文写作规范' and repeated instructions on how text should be written. Because it imposes a specific language/locale style without indicating that the user can choose another language or opt in, it conflicts with the policy against forcing a specific language without user choice.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The document title and all guidance are written as a personal style specification in Chinese, indicating the skill is expected to produce content in that language. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern unless the locale constraint is explicitly justified or optional.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This markdown file contains user-facing procedural instructions exclusively in Chinese, and there is no note that users may choose another language or locale. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation.
- Content
Whitespace Padding
Medium
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
- Content
md ### 3. 科普内容要精简 | 写法 | 评价 | | --------------------------------------------------------------------------------------------- | -------------------- | | ❌「日本《建筑基准法》规定特定建筑必须每 3 年进行一次外墙小型检查，每 10 年进行一次全面检查」 | 像教科书 | | ✅「日本有规定建筑必须定期检查和维护外墙」 | 精简，详细信息放脚注 |
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The entire skill instruction set is written in Chinese and defines review workflow, reader personas, and outputs only in that language, with no indication that users may choose another language. This can violate language/locale policy when a skill implicitly requires a specific language without explicit opt-in or a documented region-specific reason.
- Content
Static analysis
No suspicious patterns detected.