Related Skill

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:36 AM UTC
• Version: 0.1.5

Overview

This skill is for finding and installing other skills, but it gives broad skill-management command access and uses unpinned install/update commands that can persistently change the agent environment.

Review this skill before installing and treat every npx skills add, update, or remove command as a persistent change to your agent setup. Use it only if you trust the skills CLI, the inference.sh registry, and the specific skills being added; avoid bulk installs or update-all workflows unless you have reviewed the resulting skill versions and permissions.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:4

Finding

Unpinned CLI Execution and Mutable Remote Skill Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:4, SKILL.md:15-24, SKILL.md:47-99, and SKILL.md:106-113
Vulnerability Type: Unpinned third-party CLI and unverified remote Skill installation
Risk Level: Medium

The Skill grants broad permission to execute every command and argument supported by the skills CLI:

yaml

allowed-tools: Bash(npx skills *)

It then recommends invoking an unpinned npm CLI and installing mutable remote Skills:

bash

# Search for skills
npx skills search "inference-sh image generation"

# List available skills
npx skills list inference-sh/skills

# Install a skill
npx skills add inference-sh/skills@ai-image-generation

The same pattern is used for additional installations and bulk installation:

bash

npx skills add inference-sh/skills@ai-image-generation
npx skills add inference-sh/skills@ai-video-generation
npx skills add inference-sh/skills@ai-music-generation

npx skills add inference-sh/skills@inference-sh

The management instructions also permit updating installed Skills to unspecified future versions:

bash

# List installed skills
npx skills list

# Update all skills
npx skills update

# Remove a skill
npx skills remove inference-sh/skills@ai-image-generation

Technical Analysis

The command npx skills does not identify an exact reviewed npm package version or integrity digest. Depending on the local environment and npm behavior, npx can retrieve and execute the currently published package when it is not already available locally. Consequently, the code executed at audit time may differ from the code executed later.

The skills add and skills update operations likewise obtain mutable third-party Skill content without an immutable commit, release digest, signature requirement, or documented review gate. The wildcard declaration Bash(npx skills *) authorizes all subcommands and arguments accepted by the ...[truncated 1862 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the npm CLI to an exact reviewed version, for example by invoking an explicitly versioned package rather than npx skills.
2. Lock and verify the package with a trusted integrity digest and an approved registry configuration.
3. Pin every installed Skill to an immutable commit, signed release, or content digest rather than a mutable name or branch.
4. Download and inspect Skill manifests, scripts, lifecycle hooks, and permission declarations before installation.
5. Require explicit human approval before any add or update operation.
6. Replace Bash(npx skills *) with narrowly scoped permissions for specifically approved commands and arguments. Separate read-only discovery from installation and update capabilities.
7. Run installation in a sandbox using a minimally privileged account with restricted filesystem, credential, process, and network access.
8. Avoid unrestricted bulk updates. Review release differences and integrity metadata before applying each update.
9. Maintain an allowlist of approved Skill identifiers, versions, publishers, and cryptographic hashes.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (28)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The description contains broad trigger phrases like 'more capabilities', 'similar skills', and 'skill suggestions' that can match common user requests and cause the skill to activate unexpectedly. In this skill's context, overbroad activation is more dangerous because activation can lead to commands that search for, install, update, or remove local skills.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

The skill declares an allowed tool pattern of Bash(npx skills *), which permits execution of an unpinned package via npx. Because npx can resolve and execute whatever version is current at runtime, a compromised or malicious upstream release could run arbitrary code on the host when the skill is used.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 89% confidence

Finding

The documentation instructs users or agents to run npx skills search ... without pinning a package version. This creates supply-chain risk because the command may fetch and execute a newer or tampered package version at runtime.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 89% confidence

Finding

The npx skills list inference-sh/skills example references an unpinned executable resolved at runtime. If the package source is compromised, invoking the command can result in arbitrary code execution under the user's privileges.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documentation presents install commands without clearly warning that they modify the user's local skill environment. In a skill dedicated to discovering and adding capabilities, this omission materially increases the chance that an agent or user will execute state-changing commands without informed consent.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence

Finding

This install example both uses unpinned npx and performs a modifying action (skills add), increasing risk beyond a read-only query. A malicious or unexpected upstream package version could execute code and also alter the local agent skill environment.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence

Finding

This install command uses unpinned npx for adding a skill, exposing users to supply-chain compromise while also changing their environment. The combination of remote code execution risk and local configuration modification makes this more dangerous than a passive listing command.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence

Finding

The command executes an unpinned npx package for installation, which may retrieve code at runtime from the registry. If the package or dependency chain is compromised, the host and local skill setup could be altered maliciously.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence

Finding

This environment-modifying install example relies on unpinned npx, creating a supply-chain execution path. An attacker controlling an upstream release could execute arbitrary commands and install unintended content.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence

Finding

The skill recommends npx skills add ... without version pinning for image-processing installation actions. Because the command both executes remote package code and mutates the environment, compromise of the package path could have immediate local impact.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence

Finding

This install example invokes unpinned npx, exposing consumers to runtime package substitution or upstream tampering. Since the command adds a skill, exploitation could both run attacker code and persist unwanted capability changes.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence

Finding

An unpinned npx install command is presented as a normal workflow step, but it implicitly trusts the latest registry content. In a skill designed to expand capabilities, this broadens the attack surface by encouraging repeated installation of remote components.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence

Finding

This audio-processing install instruction uses unpinned npx, so package resolution occurs at execution time. A malicious upstream package version could execute code and alter the local skill environment during installation.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence

Finding

The command installs a skill through an unpinned npx invocation, which creates a supply-chain risk path. Because installation changes the local environment, exploitation impact is higher than for read-only commands.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence

Finding

This example combines unpinned npx with a skill-add action for web search, making arbitrary code execution and environment mutation possible if the resolved package is malicious. The skill's purpose of discovering and adding capabilities makes users more likely to run such commands repeatedly.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence

Finding

Using unpinned npx for adding twitter-automation exposes the system to registry/package compromise at runtime. Because this is an installation path, a successful exploit can execute code and persist new potentially sensitive automation capabilities.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence

Finding

The 'Everything at Once' installation uses unpinned npx and installs a very broad skill bundle. This magnifies impact because a single command both executes untrusted registry-fetched code and substantially expands the local attack surface.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence

Finding

This skill-combination install command relies on unpinned npx, creating supply-chain exposure during installation. In the context of composing multiple skills, the cumulative trust and mutation effects make compromise more damaging.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence

Finding

The command uses unpinned npx to add another skill, allowing execution of registry-delivered code at runtime. Repeated use in combination workflows compounds risk by increasing both dependencies and installed capabilities.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence

Finding

This content-creator workflow includes another unpinned npx install command, exposing users to remote package execution. Because the skill encourages workflow expansion, these examples can normalize unsafe installation practices across many commands.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence

Finding

The example adds a skill through an unpinned npx call, so the exact code run is not fixed. If compromised, an attacker could execute arbitrary commands and alter local capabilities during the install.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence

Finding

This installation step executes an unpinned package from the registry and changes the local environment. In aggregate with other install examples, it broadens opportunities for supply-chain abuse and accidental unsafe execution.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence

Finding

The media-processor workflow again uses unpinned npx for skill installation, exposing users to runtime code-fetching risk. Because these commands add capabilities, exploitation could both run code and persist configuration changes.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence

Finding

This add command relies on unpinned npx, which trusts whatever package version is available at execution time. That enables supply-chain compromise to affect both code execution and the user's installed skill set.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence

Finding

The example executes unpinned remote package code to install speech-to-text functionality. In a skill centered on discovering and adding more skills, this pattern encourages repeated unsafe trust in runtime-fetched code.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.