换皮肤Workbuddy

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 10:14 AM UTC
• Version: 0.1.0

Overview

This skill is a purpose-aligned WorkBuddy skinning/build helper, but users should pin and verify its npm/Tauri build dependencies before running the build commands.

Install only if you are comfortable running a Tauri/Rust desktop build workflow. Before use, inspect the copied template, require a committed lockfile, prefer npm ci, pin the Tauri CLI, and build in a clean environment without unrelated credentials.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:14

Finding

Unpinned npm Dependency Installation and Implicit npx Package Retrieval

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 14–17
Vulnerability Type: Supply-chain risk from unverified dependency installation and executable package resolution
Risk Level: Medium

Vulnerable Code Snippet

text

npm install
npm run tauri dev
npm run build
cargo check
npx tauri build --bundles nsis

Technical Analysis

The skill instructs the agent to install npm dependencies and execute the Tauri CLI through npx, but it does not require an audited lockfile, exact dependency versions, package-integrity verification, or offline resolution.

npm install can execute package lifecycle scripts with the privileges of the user running the agent. In addition, when the requested executable is unavailable locally, npx may retrieve a package from the configured npm registry and execute it. This creates a supply-chain execution boundary in which the effective code may differ from what was reviewed in the skill.

The referenced assets/wb-skin-studio/ template, its package.json, and its dependency lockfile are absent from the audited project. Therefore, the provenance, versions, lifecycle scripts, and integrity of the dependencies that these commands would install cannot be verified from the available artifact.

Attack Path

1. An attacker compromises a dependency used by the copied template, influences dependency resolution, substitutes the template, or controls the configured npm registry.
2. The agent follows the skill and runs npm install.
3. npm resolves and installs the attacker-controlled package. A lifecycle script such as preinstall, install, or postinstall executes automatically if present.
4. Alternatively, if a verified local Tauri CLI is unavailable, the agent runs npx tauri build --bundles nsis, causing npx to resolve and potentially download executable package code.
5. The malicious package executes with the privileges and environmental access of the developer or agent process.

This path is con ...[truncated 880 chars]

Remediation

View remediation

Remediation Suggestions

1. Include the referenced template, package.json, and an audited dependency lockfile in the reviewed artifact.
2. Pin dependencies to exact versions and review all transitive dependencies and lifecycle scripts before use.
3. Use npm ci rather than npm install so installation fails when the lockfile and manifest disagree.
4. Use npm ci --ignore-scripts where feasible. Explicitly document and separately approve any lifecycle scripts required by the build.
5. Require registry integrity controls, including the standard lockfile integrity hashes and a trusted, explicitly configured npm registry.
6. Install and lock the Tauri CLI as a local development dependency rather than allowing implicit npx retrieval.
7. Invoke only the verified local executable, preferably with a command that prohibits package installation, such as:

text

npm exec --offline --no -- tauri build --bundles nsis

8. Build in an isolated, least-privileged environment without unrelated credentials or sensitive environment variables.
9. Generate and verify checksums or signatures for release installers to detect build-output tampering.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

The skill instructs users to run npx tauri build --bundles nsis without pinning the package version, which can cause npx to fetch and execute whatever package version resolves at runtime. In a build/release workflow, this creates a supply-chain risk: a compromised or unexpected tauri package version could run arbitrary code on the developer machine or produce a tampered installer.

Content

No source excerpt is available for this finding.