Security checks for vulnerabilities and agentic risk
Overview
The skill is coherent, but it can run and install unverified online skill content that may change future agent behavior.
Review this skill before installing because it delegates trust to a live npm package and an online skill library. Prefer read-only/API inspection first, pin and verify any CLI package version, verify downloaded skill artifacts where possible, inspect all installed files before loading them, and run installation in a low-privilege environment without unrelated credentials.
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T08 · Insecure Dependencies
Warning
Location
SKILL.md:27
Finding
Unpinned Third-Party npm Package Execution
Content
View full analysis
-j
# Control the number of returned results (recommended to use -j for JSON format output)
npx skill4agent search -j -l
```
```bash
# Read original content (recommended to use -j for JSON format output)
npx skill4agent read -j
# Read translated content (recommended to use -j for JSON format output)
npx skill4agent read --type translated -j
```
```bash
# Install original skill
npx skill4agent install
# Install translated skill
npx skill4agent install --type translated
```
Equivalent unpinned commands also appear in `SKILL_CN.md:27-33`, `SKILL_CN.md:51-57`, and `SKILL_CN.md:75-81`.
### Technical Analysis
The documented workflow invokes `npx skill4agent` without specifying an exact package version or verifying package integrity. Depending on the local npm and `npx` configuration, this can resolve and execute the package version currently published in the configured registry.
This creates a supply-chain trust boundary in which code that was not part of the audited project can execute with the permissions of the user or Agent running the command. The effective package implementation can change after this Skill has been reviewed. Possible compromise scenarios include:
- Compromise of the package publisher's npm account.
- Publication of a malicious future release.
- Compromise or misconfiguration of the package registry.
- Registry substitution through local npm configuration.
- Dependency compromise within the transitive dependency tree.
The reviewed files do not contain evidence that the current `skill4agent` package is malicious. The vulnerabi
...[truncated 1255 chars]
Remediation
View remediation
search -j
```
2. Record and verify package integrity through a lockfile or an equivalent cryptographic integrity mechanism.
3. Configure npm to use an explicitly trusted registry and prevent unexpected registry substitution.
4. Review the selected package version and relevant transitive dependencies before approving it.
5. Execute the CLI in a sandbox or container with:
- Minimal filesystem access.
- No unnecessary credentials or environment variables.
- Restricted network access.
- No administrative privileges.
6. Update both `SKILL.md` and `SKILL_CN.md` so their security requirements remain equivalent.
7. Establish a controlled upgrade process in which each new version is reviewed before the pinned version is changed.
]]>
T08 · Insecure Dependencies
Warning
Location
SKILL.md:69
Finding
Remote Skill Installation Without Artifact Authenticity or Integrity Verification
Content
View full analysis
?type=
```
```markdown
**Parameter Description**:
- `skillId` (required): Skill ID (obtained from search results or skill detail information)
- `type` (optional): Content type (`original`/`translated`), default `original`
#### Installation Instructions
- CLI command: Installs to `.agents/skills/` directory under the current directory
- API interface: Download ZIP file and extract to get `` directory
- To install the skill to other paths (e.g., user-specified or application-required paths), move the skill directory to the target location manually
```
```markdown
## Script Security Check
Use the returned `script` field to check whether the skill contains scripts and whether sensitive code exists.
- `has_script`: `true` means the skill contains scripts
- `script_check_result`:
- `safe`: Script is safe
- `need attention`: Contains sensitive code
- `script_check_notes`: Specific locations of sensitive code, need to recheck after installation
**Note**: For skills that contain scripts with sensitive code, you must obtain user consent before installation. After installation, recheck the sensitive code locations listed in `script_check_notes` along with the code context to ensure there are no risks of malicious programs, unauthorized access to user private information, modification or deletion of local files, or changes to system configurations.
```
Equivalent download, extraction, and server-side scan-trust instructions appear in `SKILL_CN.md:69-91` and `SKILL_CN.md:93-127`.
### Technical Analysis
The workflow permits a remote ZIP archive or CLI-delivered Skill to be installed into `.agents/skills/`, but it does not require:
- A cryptographic signature.
- An expected checksum
...[truncated 2570 chars]
The skill instructs users to run npx skill4agent without pinning a specific package version, so execution will fetch whatever version is current at install time. That creates a supply-chain risk: a compromised maintainer account, malicious update, or dependency hijack could cause arbitrary code execution on the user's machine when the command is run.
Content
No source excerpt is available for this finding.
Rp1
Medium
Category
MCP Rug Pull
Confidence
96% confidence
Finding
This command again relies on an unpinned npx package, which means the executed code is not stable or reviewable over time. Because npx may download and run package code immediately, a malicious or unexpected upstream release could execute arbitrary code during a simple search operation.
Content
No source excerpt is available for this finding.
Rp1
Medium
Category
MCP Rug Pull
Confidence
96% confidence
Finding
Using npx skill4agent without a version pin exposes users to remote code execution through package substitution or a compromised future release. The danger is elevated here because the skill is explicitly about discovering and installing additional skills, so it serves as a trust gateway into further external content.
Content
No source excerpt is available for this finding.
Rp1
Medium
Category
MCP Rug Pull
Confidence
96% confidence
Finding
The read command is documented with an unpinned npx package, allowing execution of whatever code the registry currently serves for that package name. Even though the intended action is only to read skill content, the local effect of running npx is still arbitrary package code execution.
Content
No source excerpt is available for this finding.
Rp1
Medium
Category
MCP Rug Pull
Confidence
96% confidence
Finding
This translated-read example repeats the same unpinned npx execution pattern, creating a public-registry supply-chain exposure. Because users may trust the platform's security metadata and proceed quickly, the lack of version pinning undermines reproducibility and reviewability.
Content
No source excerpt is available for this finding.
Rp1
Medium
Category
MCP Rug Pull
Confidence
97% confidence
Finding
The install command is the most sensitive use of the unpinned npx package because it directly combines execution of external CLI code with installation of external skill content. A malicious package update could both run arbitrary code and manipulate installed files, making compromise more likely and more damaging.
Content
No source excerpt is available for this finding.
Rp1
Medium
Category
MCP Rug Pull
Confidence
97% confidence
Finding
This translated-install variant has the same unpinned package execution risk and inherits the elevated danger of the install workflow. Since the skill is designed to fetch and place code into local skill directories, any compromise of the CLI package can directly affect local files and future agent behavior.
Content
No source excerpt is available for this finding.
Rp1
Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding
The skill instructs users to execute npx skill4agent without pinning an exact package version, which allows whatever package version is current at execution time to run arbitrary code on the host. Because npx fetches and executes remote npm content, a compromised publisher account, malicious update, dependency hijack, or typo/replacement scenario could lead to immediate code execution.
Content
No source excerpt is available for this finding.
Rp1
Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding
This command uses npx skill4agent without a pinned version, causing the environment to download and execute the latest published package at runtime. In a skill specifically designed to search and install additional skills, this expands the trust boundary and creates a direct remote code execution path if the npm package or its dependencies are ever compromised.
Content
No source excerpt is available for this finding.
Rp1
Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding
Running npx skill4agent without version pinning exposes users to execution of unreviewed future package versions. Since this command is presented as a normal search workflow, users may treat it as low risk even though npx can execute lifecycle scripts and package code fetched from the network.
Content
No source excerpt is available for this finding.
Rp1
Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding
The read operation still relies on npx skill4agent without an exact version, so even a seemingly read-only action can execute attacker-controlled package code before any API request is made. This is dangerous because users may assume 'read' is passive, while the package invocation itself has code execution privileges.
Content
No source excerpt is available for this finding.
Rp1
Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding
This translated read command is also unpinned and therefore subject to the same supply-chain and remote execution risks as the other npx examples. The danger is amplified by the skill's role as a package/skill discovery mechanism, which may encourage repeated execution of network-fetched tooling in varied environments.
Content
No source excerpt is available for this finding.
Rp1
Medium
Category
MCP Rug Pull
Confidence
97% confidence
Finding
The install command uses unpinned npx skill4agent, combining two layers of risk: first, execution of whatever npm package version is current, and second, installation of additional skills into the local project. If the CLI package is compromised, it could alter files, implant malicious content, or exfiltrate data under the guise of installing a skill.
Content
No source excerpt is available for this finding.
Rp1
Medium
Category
MCP Rug Pull
Confidence
97% confidence
Finding
This translated install path repeats the same unpinned npx execution risk in a workflow that writes content into the local environment. In context, the skill is specifically about obtaining and installing third-party skills, so an unpinned package materially increases the chance of supply-chain compromise leading to arbitrary local changes or persistence.
Content
No source excerpt is available for this finding.
Natural-Language Policy Violations
Low
Category
Not specified by scanner
Confidence
95% confidence
Finding
The description says "Support by Chinese," which indicates a language preference or constraint in the skill metadata without offering the user a choice. This can violate language/locale policy guidance when a skill appears to force or bias a specific language absent explicit opt-in or a documented regional justification.
