Install Calibrate

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:29 PM UTC
• Version: 0.1.0

Overview

The skill has a legitimate Calibrate installation purpose, but it repeatedly runs an unpinned npm CLI that can edit projects and run with Calibrate secrets.

Review before installing. Prefer a pinned, reviewed `usecalibrate` version or a lockfile-controlled local dependency, and use disposable scoped keys for verification. Do not run the `--yes`, sidecar, or endpoint verification commands with production secrets unless the CLI version and source are trusted.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (14)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence
• Finding: The skill instructs the agent to run `npx usecalibrate ...` without pinning an exact package version or verifying integrity, which allows execution of whatever version is currently resolved from the registry. In a security-sensitive install/configuration workflow, this creates a supply-chain execution risk: a compromised latest release, typosquatted package, or unexpected upstream change could run arbitrary code on the operator's machine or modify the target repository.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence
• Finding: This command again executes `npx usecalibrate` as an unpinned remote package, exposing the workflow to arbitrary code execution via registry compromise or unreviewed upstream updates. Because this step is part of repository inspection and planning, the tool may access local files and environment context before any user notices unexpected behavior.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence
• Finding: The planning step uses `npx usecalibrate` without version pinning, so a different or malicious package version could generate altered plans, write misleading artifacts, or execute arbitrary install-time code. Since the skill presents this as deterministic planning, the lack of pinning undermines both security and reproducibility.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence
• Finding: Applying changes through `npx usecalibrate apply ...` without an exact version is especially risky because this step writes to the codebase. A compromised or changed package version could silently alter source files, inject backdoors, exfiltrate data, or perform destructive modifications under the guise of an approved plan.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence
• Finding: Even the verification step uses an unpinned `npx` package, which still permits arbitrary code execution and non-reproducible behavior despite being framed as a safety check. The surrounding skill context increases risk because users may trust verification commands and run them after providing sensitive environment variables for runtime checks.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence
• Finding: The documentation instructs users and agents to execute `npx usecalibrate` without a pinned package version, which causes whatever package version is current at execution time to be fetched and run. In an agent-installation skill, this is especially dangerous because it can lead to silent execution of newly published or compromised code, creating a supply-chain execution path with little review at the moment of use.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence
• Finding: This example again uses unpinned `npx usecalibrate`, allowing remote code execution from the npm registry at whatever version resolves at runtime. Because the command is presented as an agent-readable workflow and includes `--yes`, it reduces friction for automated execution of unreviewed package code.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence
• Finding: Using `npx usecalibrate detect` without version pinning exposes users to execution of whatever package version is currently published. Even though this is framed as a lower-level planning step, it still executes downloaded code locally and can be abused through package compromise or unexpected upstream changes.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence
• Finding: The `plan` command is also executed via unpinned `npx`, which means the planning logic and generated outputs depend on mutable remote code. In a tool that can produce file contents and installation plans, upstream compromise could influence generated artifacts or developer decisions before any code review occurs.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence
• Finding: The `apply` example executes unpinned remote package code in a path that can modify project files. That combination increases impact because a compromised or changed package version can both run arbitrary code and write unwanted changes into the user's repository.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence
• Finding: The `verify` example still runs unpinned package code fetched at runtime. While verification may sound lower risk than apply, it can still execute arbitrary code on the host and access project context, environment variables, and local files.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence
• Finding: This planning example with route arguments still relies on unpinned `npx`, leaving the executed installer logic mutable over time. Because the command shapes integration behavior and generated plans, a malicious or compromised package could alter instrumentation or inject unsafe changes under the guise of normal setup.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence
• Finding: The sidecar startup example runs `npx usecalibrate sidecar --dir .` without pinning the package version, which is particularly risky because it is paired with sensitive environment variables like admin tokens and write keys. A compromised package fetched at runtime could exfiltrate those secrets or alter runtime behavior while appearing to perform a normal local verification step.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence
• Finding: This verification command again uses unpinned `npx`, and the surrounding context instructs exporting a write key into the environment first. That makes the unpinned execution path more dangerous than a generic example, because remote package compromise could immediately access and misuse the secret during execution.

Static analysis

No suspicious patterns detected.