Tools Ui

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 10:36 AM UTC
• Version: 0.1.5

Overview

This skill is a straightforward React/Next.js UI component guide, with a real but user-controlled supply-chain caution around unpinned install commands.

Install only in a project where you are comfortable letting npx modify files, review generated changes before committing, and prefer pinned package or registry versions if reproducibility matters.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:15

Finding

Unpinned Package Execution and Mutable Remote Component Retrieval

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 15
Vulnerability Type: Unpinned third-party dependency and mutable remote registry content
Risk Level: Medium

Vulnerable Code

bash

npx shadcn@latest add https://ui.inference.sh/r/tools.json

Technical Analysis

The Quick Start command executes the npm package release currently associated with the mutable latest tag and instructs it to retrieve component definitions from a remote URL. Neither the npm package version nor the remote content is pinned to an immutable revision or protected by a documented integrity check.

Consequently, the effective installation behavior can change after this Skill has been reviewed. If the npm package, publisher account, remote registry, DNS resolution, or delivery infrastructure is compromised, a user following the documentation could receive malicious installation logic or altered project files. The audited file does not itself contain a malicious payload; the risk arises from trusting mutable third-party supply-chain inputs.

Attack Path

1. An attacker compromises the npm package release process, the package publisher account, the remote component registry, or associated delivery infrastructure.
2. The attacker publishes a malicious release under latest or replaces the content returned by https://ui.inference.sh/r/tools.json.
3. A user follows the documented Quick Start command.
4. npx downloads and executes the currently resolved package, which then retrieves the mutable remote component definition.
5. The compromised dependency or registry content executes installation behavior or introduces attacker-controlled code into the target project.
6. The introduced code may subsequently run during development, build, deployment, or application execution.

Impact Assessment

Exploitation could allow attacker-controlled code to run with the privileges of the user executing npx. Depending on that ...[truncated 453 chars]

Remediation

View remediation

Remediation Suggestions

• Replace shadcn@latest with an exact, reviewed package version.
• Prefer an immutable, versioned registry artifact rather than a mutable URL.
• Publish and verify a cryptographic checksum or signature for downloaded component definitions.
• Download and inspect generated files before allowing them to execute or enter production builds.
• Run installation in a restricted environment without production credentials or unnecessary filesystem access.
• Use lockfiles and automated dependency scanning to detect unexpected package or transitive dependency changes.
• Pin the optional related Skills referenced elsewhere in the document to reviewed, immutable versions as well.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger list includes broad phrases such as agent tools, tool ui, tool calls, and tool results, which are common terms likely to appear in many benign contexts. Overly broad activation can cause this skill to be invoked unintentionally, increasing the chance of irrelevant guidance being injected into unrelated workflows and expanding attack surface for prompt/skill routing confusion.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The Quick Start command uses npx shadcn@latest add https://ui.inference.sh/r/tools.json, which fetches and executes installer logic without a pinned, immutable version. This creates a supply-chain risk: a future upstream package or remote registry change could cause users to install modified code different from what was reviewed in this skill.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence

Finding

The documented npx skills add inference-sh/skills@agent-ui command relies on an unpinned remote package reference, so the fetched skill contents may change over time. If the upstream package is compromised or updated maliciously, users could install unexpected or unsafe code through the documented workflow.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence

Finding

The npx skills add inference-sh/skills@chat-ui example references remote installable content without an immutable version pin. This exposes users to supply-chain drift or compromise, because future executions may retrieve different code than intended by the author or reviewer.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence

Finding

The npx skills add inference-sh/skills@widgets-ui command pulls remote skill content without a fixed version, allowing silent upstream changes to affect downstream users. In documentation, this is dangerous because readers may treat the command as trustworthy and execute it directly, giving an attacker a supply-chain path if the source is altered.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.