Security audit

myskill

Security checks for vulnerabilities and agentic risk

Overview

This skill openly helps find and install other skills, but its default guidance can install persistent third-party code too broadly and with too little review.

Review this skill before installing. Use only trusted skill sources, avoid the suggested -g -y install form, prefer a pinned and vetted Skills CLI version, and require explicit confirmation after checking the exact repository, version, and destination. Do not run or import the included Python demo unless you understand that it writes sample_skill/SKILL.md and reads DASHSCOPE_API_KEY.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:25
Finding: Unpinned Package Execution and Unattended Global Skill Installation
Content: View full analysis
Vulnerability Details

File Location: SKILL.md:25-29, 49, 77-81; duplicated in references/DOC.md:25-29, 49, 77-81
Vulnerability Type: Supply-chain exposure through unpinned package execution and unverified installation sources
Risk Level: Medium

Vulnerable code snippets:

bash
npx skills find [query] npx skills add <package> npx skills check npx skills update

bash
npx skills find [query]

bash
npx skills add <owner/repo@skill> -g -y

Technical Analysis

The documented workflow invokes npx skills without specifying a fixed package version or integrity value. Depending on the local npm environment, npx may retrieve and execute the currently published package from a remote registry. Consequently, the code that executes can change after this skill has been reviewed.

The workflow also allows packages discovered through external search results to be installed without requiring an immutable revision or a trusted-publisher allowlist. The recommended -g -y options install the selected skill at user scope and suppress confirmation prompts. This increases the impact of a malicious, compromised, typo-squatted, or subsequently modified package or skill repository.

This finding is classified as an insecure dependency issue rather than confirmed malicious behavior. The reviewed files do not demonstrate that the Skills CLI or any suggested repository is currently malicious.

Attack Path

An attacker publishes a typo-squatted package or skill, compromises a legitimate registry package or repository, or causes a malicious result to appear in skill-search output.

The agent follows the documented workflow and executes the unpinned npx skills command.

npx retrieves and runs the package version available from the configured registry at execution time.

The agent selects an unverified search result and executes npx skills add with -g -y.

At ...[truncated 1097 chars]
Remediation: View remediation
Remediation Suggestions

Pin the Skills CLI to a reviewed version, for example by invoking an explicitly approved version rather than the mutable latest release.

Enforce package-lock or equivalent integrity verification where supported, and validate registry package signatures or checksums.

Restrict installation sources to an allowlist of reviewed publishers and repositories.

Pin installed skills to immutable commit hashes or signed release artifacts rather than mutable branches or tags.

Download and inspect each skill's manifest, scripts, lifecycle hooks, and referenced resources before installation.

Remove -y so that the exact package source, version, destination, and requested behavior are shown for explicit approval.

Avoid -g by default. Install into an isolated project directory or sandbox with minimal filesystem and network permissions.

Run package discovery separately from installation and require informed user authorization before any state-changing command.

Apply the same changes to both SKILL.md and its duplicate at references/DOC.md to prevent inconsistent guidance.

T09 · Insecure Skill Coding Practices

Note

Location: scripts/python/task_agent_skill.py:48
Finding: Import-Time Filesystem Side Effects and Credential Access
Content: View full analysis
Vulnerability Details

File Location: scripts/python/task_agent_skill.py:48-124
Vulnerability Type: Unsafe module initialization and unnecessary access to a sensitive environment variable
Risk Level: Low

Vulnerable code snippets:

python
os.makedirs("sample_skill", exist_ok=True) with open("sample_skill/SKILL.md", "w", encoding="utf-8") as f: f.write( """--- name: sample_skill description: Example agent skill used for demonstration --- # Example Skill ... """, )

The original source uses localized descriptive strings; the security-relevant behavior is the unconditional directory creation and file write shown above.

python
agent = ReActAgent( name="Friday", sys_prompt="You are an AI assistant named Friday.", model=DashScopeChatModel( model_name="qwen3-max", api_key=os.environ["DASHSCOPE_API_KEY"], ), memory=InMemoryMemory(), formatter=DashScopeChatFormatter(), toolkit=toolkit, ) print(agent.sys_prompt)

The original source uses localized prompt and label strings; these do not change the identified security behavior.

Technical Analysis

The Python file places demonstration logic at module scope rather than inside a function protected by an if __name__ == "__main__": guard. Importing the module therefore performs actions that callers would not normally expect from a passive import:

It creates a sample_skill directory relative to the current working directory.

It creates or truncates sample_skill/SKILL.md.

It registers and processes the generated skill.

It reads DASHSCOPE_API_KEY from the importing process's environment.

It initializes a third-party model client and agent configuration.

It prints generated agent prompts.

The fixed relative path does not provide an attacker-controlled path-injection primitive in the reviewed code. The file also does not print or ...[truncated 2003 chars]
Remediation: View remediation
Remediation Suggestions

Move executable demonstration behavior into a dedicated main() function.

Protect execution with if __name__ == "__main__": so imports remain free of filesystem, credential, model-initialization, and output side effects.

Use tempfile.TemporaryDirectory for demonstration skill content instead of writing into the caller's current working directory.

Check for the required environment variable only immediately before an explicitly requested model operation, and return a clear error without exposing the value.

Do not initialize external service clients during module import.

Avoid printing complete generated system prompts unless the user explicitly enables demonstration or debug output.

Separate this unrelated AgentScope example from the runtime skill package if it is not required for the declared skill-discovery workflow.

Add tests verifying that importing the module does not modify files, access credentials, initialize external clients, or write to standard output.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (39)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The declared description says this skill should be used to help users find and install relevant skills when they ask for new functionality. The supplied code does not implement discovery, recommendation, matching, or installation behavior. It is an example/tutorial script for developers that creates a sample skill folder and SKILL.md file, registers that local skill with a Toolkit, prints generated prompts, and wires the toolkit into a ReActAgent. This is a materially different primary purpose from a user-facing skill finder/installer, so it should be flagged as a mismatch.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 79% confidence
Finding: The skill directs the agent to run commands that search for and install external packages, but it declares no explicit tool scope or permission boundary. In a skill whose core function is discovering and installing third-party code, missing tool restrictions increases the chance of unintended command execution or file/system changes without adequate policy guardrails.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The routing guidance is broad enough that the skill may trigger on ordinary help-seeking language such as 'how do I do X' or 'can you do X'. In this skill's context, accidental invocation is more dangerous because the skill can lead the agent toward discovering and installing external code rather than just answering a question directly.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The listed activation conditions are ambiguous and overlap with many normal assistance requests, which can cause over-invocation. Because this skill recommends remote package execution and installation, false-positive routing can unnecessarily expose users to supply-chain and installation risk.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: Using npx skills without a pinned version causes the latest package to be fetched and executed at runtime, creating a supply-chain risk. If the upstream package is compromised or changes behavior, the agent may execute unreviewed code while searching for or installing skills.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: This command reference uses npx skills without version pinning, so execution depends on whatever package version is current at runtime. That exposes users to supply-chain compromise and unexpected behavior changes from the external package registry.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: This unpinned npx skills invocation may retrieve and execute an unreviewed package version from the registry at the moment of use. In a skill intended to discover or install more code, this compounds supply-chain exposure and can lead to arbitrary code execution.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: Referencing npx skills without pinning a version leaves the executed code mutable over time and vulnerable to upstream compromise. Because the command participates in software installation workflow, a compromised package could directly alter the user's environment.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: An unversioned npx skills update command can fetch and run whatever code is current in the registry, making behavior non-deterministic and increasing supply-chain risk. Update flows are particularly sensitive because they encourage widespread execution across existing environments.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: This search command still relies on unpinned npx skills, which means the search operation itself may execute arbitrary package code from the registry. Even seemingly read-only operations are risky when delivered through dynamic package execution.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The example command uses npx skills without any version constraint, exposing the workflow to upstream package compromise. Since users may copy and run examples directly, this materially increases the chance of executing malicious or altered code.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: This example search command is unpinned and therefore executes mutable third-party code. In documentation that encourages discovery of installable skills, the lack of pinning normalizes unsafe package execution practices.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The unpinned npx skills example can resolve to arbitrary future versions, enabling supply-chain abuse. Because the skill is a discovery-and-installation helper, this creates a dangerous trust chain from documentation to code execution.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: Presenting npx skills add <owner/repo@skill> without pinning the CLI version means the agent may execute a compromised or changed installer. This is especially risky because the command then installs additional external code selected from user-facing results.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 96% confidence
Finding: The installation example again uses unpinned npx skills, exposing copy-paste users to registry-based supply-chain attacks. Since this command installs a skill package, compromise could result in persistent malicious code on the host.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill instructs the agent to run a global install with -y, which bypasses confirmation and can silently install code from external sources into the user's environment. In a package-installation skill, omitting explicit risk warnings and trust checks materially increases the likelihood of unsafe, persistent compromise.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 97% confidence
Finding: npx skills add <owner/repo@skill> -g -y combines unpinned package execution with global installation and confirmation bypass, making compromise more severe and easier to trigger. If the upstream CLI or the target skill is malicious, the user may silently install persistent code without review.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: This reference to npx skills init is still unpinned and may execute an arbitrary package version from the registry. Although initialization is less sensitive than installation, it still runs remote code that can create or modify local files.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: The final npx skills init my-xyz-skill example remains vulnerable to mutable upstream code execution. Because users may copy this directly, it can lead to unauthorized local file creation or execution of compromised scaffolding logic.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The metadata description defines activation around very common user intents like 'how do I do X' and 'can you do X', which can cause this skill to trigger in many ordinary conversations. In this context, over-broad activation is security-relevant because the skill's next action is to recommend or perform installation of external code, creating unnecessary exposure and opportunities for prompt-driven tool misuse.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The usage criteria are ambiguous and overlap with generic requests for help, specialized capabilities, and domain assistance. Because this skill promotes execution and installation workflows, ambiguous triggering can inappropriately steer users toward third-party skill discovery when they only wanted direct assistance, increasing supply-chain risk and unnecessary command execution.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: The document repeatedly instructs use of npx skills without pinning an exact package version, so execution will resolve whatever package version is current at runtime. Because this skill is specifically about discovering and installing more code from external sources, an upstream package compromise, typo-squatting, or malicious update could lead to arbitrary code execution in the user's environment.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: This command reference uses npx skills without a fixed version, allowing the fetched executable to change over time. In a skill whose purpose is to install additional capabilities from remote sources, that materially increases supply-chain and remote code execution risk.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: The example npx skills add <package> is unpinned and implicitly trusts remote package resolution at execution time. Since the command installs code from GitHub or other sources, a compromised CLI or dependency chain could directly execute attacker-controlled code or install malicious skills.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 92% confidence
Finding: npx skills check is presented without a pinned version, so even a seemingly read-only command may execute a newly published or compromised CLI version. This is less severe than installation but still introduces avoidable supply-chain execution risk.
Content: No source excerpt is available for this finding.

Overview

A.I.G

T08 · Insecure Dependencies

Vulnerability Details

Technical Analysis

Attack Path

Remediation Suggestions

T09 · Insecure Skill Coding Practices

Vulnerability Details

Technical Analysis

Remediation Suggestions

SkillSpector

Tp4

Undeclared Tool Scope

Vague Triggers

Vague Triggers

Rp1

Rp1

Rp1

Rp1

Rp1

Rp1

Rp1

Rp1

Rp1

Rp1

Rp1

Missing User Warnings

Rp1

Rp1

Rp1

Vague Triggers

Vague Triggers

Rp1

Rp1

Rp1

Rp1