Agent Skills

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 8:54 AM UTC
• Version: 1.0.1

Overview

This is a documentation-only skill for creating and evaluating agent skills, with no hidden runtime code or automatic actions.

Reasonable to install as a reference skill. When following its script examples, prefer pinned versions, reviewed dependencies, dry runs for file-changing commands, and explicit approval before running tools that download packages from registries.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: references/using-scripts.md:7

Finding

Unverified Third-Party Packages Are Downloaded and Executed

Content

View full analysis

Vulnerability Details

File Location: references/using-scripts.md, lines 7–11
Vulnerability Type: Third-party dependency supply-chain exposure
Risk Level: Medium

Vulnerable Code

markdown

| `uvx` | `uvx ruff@0.8.0 check .` | Python isolated env |
| `npx` | `npx eslint@9 --fix .` | Bundled with Node.js |
| `bunx` | `bunx eslint@9 --fix .` | Bun equivalent of npx |
| `deno run` | `deno run npm:eslint@9 -- --fix .` | Requires permission flags |
| `go run` | `go run golang.org/x/tools/cmd/goimports@v0.28.0 .` | Bundled with Go |

Technical Analysis

These documented one-shot commands may resolve, download, and immediately execute code from external package registries or module sources. Although versions are specified, eslint@9 is a mutable major-version range rather than an exact immutable release. None of the examples require dependency lockfiles, cryptographic checksums, signature verification, provenance validation, or prior package review.

Package execution can include the selected tool's runtime code and, depending on the package manager and package, installation lifecycle logic. Consequently, compromise of a publisher account, registry, dependency, release artifact, or package-resolution path could cause attacker-controlled code to execute with the permissions of the Agent process.

Attack Path

1. A user asks the Agent to perform linting, formatting, or related script operations.
2. The Agent loads references/using-scripts.md and follows one of the documented one-shot command examples.
3. The selected package manager contacts an external registry or module source.
4. It resolves and downloads the named package and its transitive dependencies without integrity requirements defined by this Skill.
5. A compromised or malicious resolved component executes locally.
6. The payload accesses or modifies resources available to the Agent process. In particular, eslint@9 --fix . is expressly authorized to modify files beneath ...[truncated 480 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin every dependency to an exact, reviewed release rather than a major-version range such as eslint@9.
2. Use lockfiles with verified integrity hashes and enforce immutable or frozen dependency resolution.
3. Validate package signatures, checksums, and available provenance attestations before execution.
4. Prefer reviewed, preinstalled, or vendored tools over commands that download and execute packages on demand.
5. Require explicit user approval before any command performs network retrieval or executes newly downloaded code.
6. Run third-party tooling in a restricted sandbox with minimum filesystem, environment-variable, credential, and network access.
7. Disable unnecessary package lifecycle scripts where the relevant package manager supports that control.
8. Run file-modifying operations such as --fix . only after reviewing a dry-run or proposed diff, and restrict their working directory to the intended project.

SkillSpector

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Self-Modification

High

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · references/quick-start.md (reported line 11)May include surrounding context.

Directory name = skill name, kebab-case. Prefer verb-noun phrases (pdf-processing, weather-check).

2. Write SKILL.md

markdown

---

Static analysis

No suspicious patterns detected.