Ecommerce Content Marketing

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 8:49 AM UTC
• Version: 0.1.0

Overview

This skill is a coherent content-marketing planner that uses public web research; users should be cautious with the unpinned global install command and avoid sharing private account data.

Before installing, prefer a pinned or reviewed version of the installer and source repository, and consider project-local installation instead of global installation if available. When using the skill, provide public brand names, public handles, or public URLs where possible, and avoid sharing confidential client strategy, private dashboards, credentials, or personal mixed-use accounts unless you intend them to be analyzed.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:13

Finding

Unpinned Third-Party Global Installation Creates a Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 13-17
Vulnerability Type: Unpinned third-party dependency and mutable installation source
Risk Level: Medium

Vulnerable Code

markdown

## Installation

```bash
npx skills add nexscope-ai/eCommerce-Skills --skill ecommerce-content-marketing -g

text

### Technical Analysis

The documented installation command invokes the `skills` npm CLI through `npx` without specifying an exact package version. It then installs Skill content globally from the mutable `nexscope-ai/eCommerce-Skills` repository reference without pinning an immutable commit or verifying artifact integrity.

As a result, the components installed when a user runs this command may differ from those reviewed during this audit. The effective installation content depends on the latest package and repository state at execution time. Compromise of the npm package, source repository, release process, or a maintainer account could therefore expose users to modified code or malicious Skill instructions.

The audited project itself contains only `SKILL.md`; no embedded malicious scripts, credential access, persistence mechanisms, privilege escalation, or local execution payloads were found. The risk arises specifically from the external, unpinned installation path.

### Attack Path

1. An attacker compromises the npm package used by `npx`, the referenced repository, a maintainer account, or the associated release pipeline.
2. The attacker publishes a malicious CLI version or modifies the repository content resolved by the mutable reference.
3. A user follows the documented installation command.
4. `npx` retrieves the currently resolved CLI package, and the command retrieves Skill content from the current upstream repository state.
5. The unreviewed content is installed globally.
6. Depending on the compromised component's behavior, malicious code could execute during installation or malicious Skill instructions could affect later a
...[truncated 704 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the npm CLI to an exact, audited version rather than allowing npx to resolve the latest version:

   bash

   npx --yes skills@<exact-version> ...
   

2. Pin the Skill source to an immutable Git commit or a cryptographically verified release artifact instead of a mutable repository reference.
3. Publish and verify SHA-256 checksums or signed provenance for installation artifacts.
4. Avoid global installation unless it is operationally necessary. Prefer a project-local, isolated installation with minimal permissions.
5. Configure npx to avoid unexpected package resolution and interactive package substitution.
6. Review dependency lockfiles and release provenance before publishing installation instructions.
7. Run installation in a sandbox or restricted environment that has no access to production credentials or sensitive user files.
8. Re-audit the exact pinned release whenever the dependency or source revision is updated.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

The installation command uses npx skills without pinning a specific package version, so users may execute whatever version is current at install time. This creates a supply-chain risk: a compromised or breaking upstream release could run unexpected code during installation or alter behavior after publication.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill instructs activation on vague, broad content-related requests, which increases the chance of unintended invocation and over-collection of user/business data. In this skill's context, accidental activation can prompt for brand handles, URLs, competitors, and market data even when the user did not clearly request external research or competitive analysis.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill requests social handles, website URLs, and competitor identifiers without a user-facing privacy notice or minimization guidance. While this is business-oriented data, it can still expose account associations, unpublished strategy context, or sensitive client information, especially if users provide personal or mixed-use accounts.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.