Favicons

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 6:12 AM UTC
• Version: 1.0.0

Overview

This skill transparently generates website icon files using the standard favicons Node.js library, with no hidden persistence or unrelated data access found.

Install only in a project where generating favicon assets is intended. Prefer pinning `favicons` to a reviewed exact version, use a lockfile, and run the generator against a dedicated output directory to avoid overwriting existing files.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:16

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 16–20
Vulnerability Type: Supply-chain exposure through an unpinned npm dependency
Risk Level: Medium

markdown

Ensure `favicons` is installed in the project before execution:

```bash
npm install favicons

text

### Technical Analysis

The documented installation command does not specify an exact reviewed version of the `favicons` package. Consequently, npm resolves the version from mutable registry metadata at installation time. The effective dependency implementation can therefore change after this Skill has been audited without requiring any change to the repository.

npm installation can also execute dependency lifecycle scripts unless they are explicitly disabled. If the package publisher account, npm registry distribution, or a future package release is compromised, following this instruction could install and potentially execute attacker-controlled code. The project does not include a lockfile or integrity metadata that would constrain installations to a known artifact.

### Attack Path

1. An attacker compromises the `favicons` package publisher account, registry distribution channel, or a future release.
2. The attacker publishes a malicious version or modifies the package artifact resolved by the unpinned package name.
3. A user follows the documented `npm install favicons` instruction.
4. npm retrieves the currently resolved mutable version rather than a previously reviewed exact artifact.
5. Malicious lifecycle code may execute during installation, or malicious library code may execute when `scripts/generate_favicons.js` imports and invokes the package.
6. The payload operates with the permissions and environment access of the npm or Node.js process.

### Impact Assessment

Successful exploitation could provide arbitrary code execution under the account running npm or the favicon-generation script. The resulting scope may include read
...[truncated 423 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin favicons to a reviewed exact version rather than using an unconstrained package name:

   bash

   npm install --save-exact favicons@<reviewed-version>
   

2. Commit package.json and package-lock.json, including npm integrity hashes, to the Skill package.
3. In automated or reproducible environments, install dependencies with:

   bash

   npm ci
   

4. Review the selected package version, its transitive dependency tree, provenance, and lifecycle scripts before approving an upgrade.
5. If dependency lifecycle scripts are unnecessary, consider installing with --ignore-scripts after confirming that doing so does not break required functionality.
6. Execute dependency installation and icon generation in a sandbox or least-privileged environment without unrelated credentials or sensitive filesystem access.
7. Introduce dependency scanning and lockfile verification in CI, and require explicit review for package or integrity-hash changes.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The reference defines lang with a default of "en-US", which imposes a specific locale in natural-language configuration guidance. Because the file does not mention user opt-in, choice, or a region-specific justification, this may conflict with language/locale policy requirements.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

This markdown file explicitly states that image buffers and configuration files will be written, including files like manifest.json and browserconfig.xml, but it does not include any warning or disclosure about modifying the user's filesystem. Under the markdown-specific SQP-2 criteria, documentation should warn when behavior can affect user data or system state.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.