Rule Spec

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 5:36 AM UTC
• Version: 1.0.7

Overview

This skill is a coherent rules-management helper, but users should be careful because it runs an unpinned npm CLI and may handle sensitive business rules.

Install only if you trust the rulespec npm package and publisher. Prefer pinning an exact reviewed version, running it in a least-privileged workspace, and keeping sensitive business rules or examples out of prompts sent to untrusted model providers.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:20

Finding

Unpinned npm Package Is Downloaded and Executed at Runtime

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 20
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code Snippet:

markdown

All commands use `npx rulespec` — no global install needed. npx downloads and runs it automatically.

Technical Analysis

The skill directs the agent to execute npx rulespec without specifying an exact package version, integrity hash, lockfile, or other trusted provenance control. npx may retrieve the package from the configured npm registry and execute package-controlled code on the local system.

Because dependency resolution occurs at invocation time, the package code ultimately executed can differ from the code available when this skill was audited. A compromised maintainer account, malicious package release, registry compromise, dependency confusion caused by an untrusted registry configuration, or compromise of the package's transitive dependencies could therefore introduce arbitrary executable behavior.

The audited project does not itself contain a malicious script, and no evidence establishes that the current rulespec package is malicious. The risk arises from instructing automatic execution of an unpinned, remotely retrieved dependency without verification.

Attack Path

1. An attacker compromises the npm package, a maintainer account, a transitive dependency, or the registry resolution path and publishes or serves a malicious version.
2. An agent follows SKILL.md and invokes a command using npx rulespec.
3. npx resolves and downloads the package version available through the configured registry.
4. Package lifecycle hooks or CLI entry-point code execute under the invoking user's account.
5. The malicious code performs actions permitted by that account, potentially including reading accessible files, altering project content, accessing environment variables, or making network requests.

Impact Assessment

Suc ...[truncated 499 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the CLI to an exact reviewed version, for example npx --yes rulespec@X.Y.Z, rather than resolving the latest release.
2. Declare the package in a project manifest and commit a lockfile containing integrity metadata.
3. Install dependencies with a deterministic command such as npm ci and execute the locked local binary with npx --no-install rulespec or an equivalent package script.
4. Verify the package's official registry namespace, repository, publisher identity, signatures or provenance attestations, and integrity hashes.
5. Review direct and transitive dependency changes before upgrades and use automated dependency and provenance scanning.
6. Disable or strictly control package lifecycle scripts where operationally feasible.
7. Run the CLI in a sandbox or least-privileged environment with restricted filesystem, credential, and network access.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · SKILL.md (reported line 79)May include surrounding context.

rulespec compile [id] # Preview compiled prompts rulespec validate # Check file against schema rulespec emit # Generate skills/{domain}/SKILL.md rulespec emit --include-examples true # Include examples in output rulespec emit --outdir # Custom output dir (default: skills)

text

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The activation criteria are very broad, covering generic requests like 'add a rule', 'create a policy', 'set a constraint', and policy-related topics generally. Overbroad triggers can cause the skill to activate in contexts where the user did not intend to modify or generate agent-governing rules, increasing the chance of unintended prompt/policy changes or exposure of internal rule content.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The skill instructs users to run npx rulespec, which fetches and executes the latest package version at runtime rather than a pinned, reviewed version. This creates a supply-chain risk: a compromised package release or dependency could result in arbitrary code execution on the user's machine when following the documented workflow.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The skill instructs users to run npx rulespec, which fetches and executes the latest package version at runtime rather than a pinned, reviewed version. This creates a supply-chain risk: a compromised package release or dependency could result in arbitrary code execution on the user's machine when following the documented workflow.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill explicitly recommends injecting compiled rules into system prompts or API calls at runtime, but does not warn that those rules may contain sensitive business logic, internal policies, or examples that could be transmitted to external model providers. In a rules-management skill, this context makes accidental disclosure more plausible because users may encode proprietary workflows, thresholds, or compliance controls in the rules.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.