Phy Graphql Schema Audit

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 5:05 AM UTC
• Version: 1.0.3

Overview

This is a local GraphQL schema-audit skill with some scope and reliability caveats, but no evidence of hidden exfiltration, persistence, or destructive behavior.

Reasonable to install for local GraphQL schema review, but do not treat its deprecated-operation results as complete unless operation parsing is added. Review before letting it scan an entire repository, and avoid the unpinned npx command unless you trust the package source or have installed a pinned local dependency.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:49

Finding

Unpinned Third-Party Package Execution via npx

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:49
Vulnerability Type: Unsafe execution of an unpinned third-party dependency
Risk Level: Medium

Vulnerable Code

bash

npx get-graphql-schema http://localhost:4000/graphql > schema.json

The same command is repeated in generated guidance at SKILL.md:97.

Technical Analysis

The documented command invokes get-graphql-schema through npx without specifying a package version, lockfile, integrity hash, or trusted package source. If the package is not already available locally, npx may retrieve it and execute its code with the invoking user's permissions.

Although the GraphQL endpoint is limited to localhost, that restriction applies only to the command's intended schema request. It does not restrict the downloaded package or its transitive dependencies. Package code can access files, environment variables, credentials available to the user, local network services, and external network destinations.

This is unnecessary for the Skill's declared local static-analysis functionality. Users can provide an existing SDL or introspection JSON file, or the documentation can require a pinned and reviewed local dependency.

Attack Path

1. An attacker compromises, replaces, or otherwise gains control over the referenced npm package or one of its transitive dependencies.
2. A user follows the Skill's documented npx get-graphql-schema instruction.
3. npx resolves and downloads the currently published, unpinned package code.
4. The retrieved package or dependency executes with the user's privileges.
5. Malicious code can read accessible project data or credentials, execute commands, modify files, or transmit information over the network.

Impact Assessment

Successful exploitation would provide code execution under the account running the command. The accessible scope may include the current project, other user-readable files, environment va ...[truncated 502 chars]

Remediation

View remediation

Remediation Suggestions

1. Do not recommend dynamically executing an unversioned package through npx.
2. Pin a reviewed package version as a project development dependency and commit the package manifest and lockfile.
3. Invoke the installed local binary in a way that prohibits fallback downloads, such as npx --no-install, after verifying the package is installed.
4. Use package-manager integrity verification and automated dependency scanning.
5. Prefer a GraphQL server's built-in schema export or introspection mechanism where practical, avoiding dynamically retrieved executable tooling.
6. Clearly inform users that introspection output may reveal sensitive schema metadata and should remain local unless they explicitly authorize disclosure.
7. Apply the same correction to the repeated command at SKILL.md:97.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill claims it can detect deprecated fields still used in operations, but the provided implementation contains no logic to parse operation files or correlate them with deprecated schema fields. This is dangerous because it can give users false assurance that deprecated-field usage has been audited, causing missed migration or security-relevant cleanup work.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger list includes generic phrases such as "review my schema", "query complexity", and "introspection json" that are not narrowly scoped to invoking this specific skill. In a markdown skill description, these vague triggers can overlap with normal user requests and increase the chance of accidental activation.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill advertises 'pure local file analysis' of schema SDL/introspection input, but it also searches application source files to infer whether depth-limit middleware is configured. That discrepancy can cause users to expose a broader portion of their repository than expected and undermines trust in the skill's stated scope, even though it remains local-only rather than exfiltrating data externally.

Content

No source excerpt is available for this finding.