Phy Memory Leak Detector

• Outcome: Review
• Latest audit: Sep 14, 2026 · 10:55 PM UTC
• Version: 1.0.3

Overview

The skill is a plausible memory-leak scanner, but its optional runtime workflow asks users to execute unpinned npm tools and run local load tests without enough containment guidance.

Install only if you are comfortable reviewing and controlling the runtime steps. Prefer using this for static analysis first, and run heap profiling or load tests only in an isolated test environment with pinned, lockfile-managed versions of clinic and autocannon, not against production services or sensitive local sessions.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:346

Finding

Unpinned Third-Party Package Download and Execution via npx

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:346, SKILL.md:383-385
Vulnerability Type: Insecure dependency acquisition and execution
Risk Level: Medium

Vulnerable Code

bash

npx clinic heapprofiler -- node --expose-gc server.js &

bash

# 3. Use clinic.js for visual flame graph
npx clinic flame -- node server.js
# Then run load test with autocannon:
npx autocannon -c 10 -d 30 http://localhost:3000/api/users

Technical Analysis

The runtime workflow invokes clinic and autocannon through npx without pinned versions, a committed lockfile requirement, integrity constraints, or --no-install. If these packages are not available locally, npx can retrieve them from the configured npm registry and immediately execute their CLI code.

This creates a supply-chain execution boundary in which the effective code can change after the Skill has been reviewed. A compromised package release, maintainer account, transitive dependency, registry, or package-resolution configuration could cause attacker-controlled code to run under the invoking user's account.

Runtime profiling and load generation are relevant to the declared memory-leak analysis functionality. However, dynamically downloading executable packages is not the minimum privilege necessary: reviewed and version-pinned development dependencies can provide the same functionality.

Attack Path

1. A user follows the optional heap-profiling or load-testing instructions.
2. npx attempts to resolve clinic or autocannon.
3. If the requested package is unavailable locally, npx downloads the current registry-resolved package and its dependency tree.
4. Package lifecycle behavior and CLI code execute with the permissions of the invoking user.
5. If any resolved component is compromised, it can read accessible project files and user-level credentials, modify files, execute child processes, or communicate over the network.

...[truncated 1027 chars]

Remediation

View remediation

Remediation Suggestions

1. Add reviewed, exact versions of clinic and autocannon as development dependencies and commit the package lockfile.
2. Invoke only locally installed binaries through package scripts or use npx --no-install so execution fails rather than downloading code dynamically.
3. Enforce lockfile integrity in CI with a deterministic installation command such as npm ci.
4. Review the packages and their transitive dependencies before adoption, and monitor them for security advisories.
5. Use a trusted registry configuration and prevent untrusted project-level registry overrides.
6. Require explicit user confirmation before starting servers, profilers, or load tests.
7. Run optional runtime analysis in an isolated, least-privileged environment without production credentials or sensitive environment variables.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The manifest description explicitly says the skill is a scanner for Node.js, Python, Go, and Java, and the docs repeat that it supports Java. However, the actual implementation only maps patterns for .js/.jsx/.ts/.tsx/.mjs, .py, and .go files; there are no Java patterns and no .java extension handling. This is a direct description-behavior mismatch about core supported languages.

Content

No source excerpt is available for this finding.

Unbounded Output

Medium

• Category: Output Handling
• Confidence: 75% confidence

Finding

Output size or generation rate is not bounded. Unbounded output enables denial-of-service through resource exhaustion, log flooding, or context-window stuffing.

Content

Scanner excerpt · SKILL.md (reported line 147)May include surrounding context.

md

'fix': "Add emitter.off(event, handler) in cleanup, or use emitter.once() for one-time listeners",
    },

    # Global Map/Set growing inside a module (cache without size limit)
    {
        'name': 'UNBOUNDED_CACHE',
        'pattern': re.compile(

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The heap-diff workflow launches a server, sends 100 HTTP requests, and suggests additional load testing without clear warnings about side effects. In real environments this can mutate data, trigger emails/jobs, stress dependencies, or disrupt a locally running service, making the skill more dangerous because it presents the procedure as routine diagnostics.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 82% confidence

Finding

The skill instructs users to run npx clinic without pinning a package version, which can pull and execute whatever version is current at runtime. In a security-sensitive agent skill, unpinned executable package resolution increases supply-chain risk and makes behavior non-reproducible.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 82% confidence

Finding

This is a second instance of unpinned npx clinic, again causing execution of a remotely resolved package version at run time. Even though the tool is legitimate, the skill content is operational guidance that can lead to arbitrary code execution if the upstream package or dependency chain is compromised.

Content

No source excerpt is available for this finding.

Unbounded Output

Medium

• Category: Output Handling
• Confidence: 75% confidence

Finding

Output size or generation rate is not bounded. Unbounded output enables denial-of-service through resource exhaustion, log flooding, or context-window stuffing.

Content

Scanner excerpt · SKILL.md (reported line 509)May include surrounding context.

🟠 4 unbounded Maps — userCache, sessionCache, configCache, tokenCache (no eviction) 🟡 7 useEffect without cleanup return

Worst offender: userCache (Map with no size limit, user.ts:12) Quick fix: npm install lru-cache → replace new Map() with new LRU({ max: 1000 }) Runtime confirm: node --expose-gc + 100 req test → should show heap growth

text

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The inline documentation labels Step 1 as 'Detect Logging Framework,' which contradicts the enclosed code that only imports modules and defines the LeakFinding dataclass. There is no logging framework detection logic in that section, making the comment/documentation actively misleading about what the code does.

Content

No source excerpt is available for this finding.