Phy Regex Audit

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 5:06 AM UTC
• Version: 1.0.3

Overview

This skill is a disclosed local regex-audit guide, with some caution needed around project file scanning and optional unpinned npm commands.

Install only if you are comfortable with the agent reading source files in the target project to find regex patterns. Prefer invoking it with an explicit path or --pattern for narrow reviews, and avoid running the suggested npm/npx commands unless you pin versions or use an isolated environment.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:577
• Finding: Unpinned Third-Party Package Execution Through npx## Vulnerability Details **File Location**: `SKILL.md`, line 577 **Vulnerability Type**: Unpinned third-party package execution **Risk Level**: Medium **Vulnerable Code:** ```markdown - **safe-regex** npm package: `npx safe-regex "your-pattern"` — quick single-pattern check ``` ### Technical Analysis The skill recommends executing `safe-regex` through `npx` without specifying a package version, integrity digest, lockfile, or trusted package source. If the package is not already installed locally, `npx` can retrieve and execute the version currently resolved by the configured npm registry. This creates a mutable supply-chain execution path: the code executed when a user follows the recommendation may differ from the code available when the skill was audited. A compromised package release, registry account, registry configuration, or package-resolution environment could therefore cause attacker-controlled code to run. The recommendation is particularly unnecessary because the skill describes itself as a pure static-analysis tool. ### Attack Path 1. An attacker compromises the referenced package, its publisher account, or a registry used by the victim. 2. The attacker publishes or serves a malicious package version. 3. A user follows the skill's recommendation and runs `npx safe-regex "your-pattern"`. 4. `npx` resolves and downloads the unpinned package version. 5. Package runtime code or applicable lifecycle behavior executes with the invoking user's permissions. 6. The malicious code accesses or modifies resources available to that user. ### Impact Assessment Successful exploitation could execute arbitrary code with the privileges of the user running `npx`. The accessible scope may include the audited project, writable files, environment variables, development credentials available to the process, and network resources reachable from the host. The instruction does not itself elevate privileges or establish persistence; i ...[truncated 72 chars]
• Remediation: ## Remediation Suggestions - Remove the external package-execution recommendation and rely on the skill's local static-analysis implementation. - If the package must be used, specify an audited exact version rather than allowing mutable latest-version resolution. - Install through a committed lockfile with integrity metadata and use a trusted, explicitly configured registry. - Disable dependency lifecycle scripts where compatible with the selected package and workflow. - Verify package provenance, publisher identity, release signatures or attestations, and integrity before execution. - Run third-party analysis tools in an isolated environment with minimal filesystem, credential, and network access.

T08 · Insecure Dependencies

Note

• Location: SKILL.md:487
• Finding: Unpinned npm Dependency Installation Recommendation## Vulnerability Details **File Location**: `SKILL.md`, line 487 **Vulnerability Type**: Unsafe dependency installation guidance **Risk Level**: Low **Vulnerable Code:** ```typescript // npm install validator → isEmail(str) ``` ### Technical Analysis The remediation example recommends installing `validator` without pinning an audited version or requiring integrity and provenance verification. An unversioned `npm install` resolves a mutable package release according to registry state and package-manager configuration. npm installation can execute package lifecycle scripts unless they are disabled. Consequently, compromise of the referenced package, publisher account, registry, or dependency tree could turn the suggested remediation into a supply-chain code-execution path. The command is illustrative guidance rather than an automatically executed setup step, which reduces likelihood but does not eliminate the risk for users who follow it. ### Attack Path 1. An attacker compromises the package publisher, a transitive dependency, or the registry used by the victim. 2. A malicious or altered version becomes the version selected by unpinned resolution. 3. A user follows the recommendation and runs `npm install validator`. 4. npm downloads the selected package and its dependency tree. 5. Malicious installation scripts or subsequently imported package code execute in the user's environment. 6. The malicious component operates within the permissions available to the npm process or consuming application. ### Impact Assessment During installation, successful exploitation could execute code with the installing user's permissions and access project files, writable user data, exposed environment variables, and reachable network services. If malicious package code is later imported into an application, its effective scope would match that application's runtime privileges. No direct privilege escalation or persistence mechanism is pres ...[truncated 24 chars]
• Remediation: ## Remediation Suggestions - Pin a reviewed, exact package version and record it in a committed lockfile. - Require lockfile integrity verification and use a trusted registry. - Review direct and transitive dependencies before adoption. - Disable lifecycle scripts during installation where operationally feasible. - Use package provenance attestations, signature verification, and automated dependency monitoring. - Prefer a locally implemented validator when its required behavior is simple and can be safely maintained. - Execute dependency installation and validation tooling in a least-privileged, isolated build environment without unnecessary credentials.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The trigger phrases are broad natural-language requests like 'is this regex safe' and 'regex performance', which can overlap with ordinary conversation and cause the skill to activate unexpectedly. In this skill's context, unexpected activation is more concerning because the skill is designed to recursively scan source files and inspect project contents, so an accidental trigger could lead to unanticipated file access.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence
• Finding: The skill recommends running `npx safe-regex` without pinning a specific package version. Because `npx` resolves and executes code from the registry at runtime, this creates a supply-chain risk: a future malicious or compromised release could execute arbitrary code on the user's machine when they follow the documented command.

Missing User Warnings

Low

• Confidence: 89% confidence
• Finding: The skill description emphasizes static analysis but does not clearly warn that it will recursively enumerate source files and read file contents. This weakens informed consent and can surprise users into exposing more local code and sensitive project data than they intended, especially when combined with broad triggers and default current-directory scanning.

Static analysis

No suspicious patterns detected.