Regulator-ready SBOM

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:53 PM UTC
• Version: 1.0.0

Overview

This skill is aimed at SBOM release validation, but it deserves review because it can send attached release SBOMs to a hosted service and uses an unpinned installer command.

Before installing, confirm that your organization permits PowMCP to receive full SBOM contents. Use this mainly with public or already-approved SBOMs, prefer the documented local or CI validation path for confidential or pre-release artifacts, and avoid running the unpinned `npx` installer from an elevated shell.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:74
• Finding: Attached SBOMs may be transmitted to an external service without explicit consent## Vulnerability Details **File Location**: `SKILL.md:74-80`, `SKILL.md:115-117`, `agents/openai.yaml:7-13`, and `references/sbom-preflight.md:17-35` **Vulnerability Type**: External disclosure of potentially sensitive release metadata **Risk Level**: Medium **Relevant code snippets:** `SKILL.md:74-80` ```markdown Use one publicly fetchable HTTP(S) SBOM URL or one SBOM file attached in the conversation. Provide one source kind, not both. Do not repeat URL query strings or credentials in narration. The source must be no larger than 10 MB. Local paths, pasted SBOM bodies, data URLs, FTP or SFTP sources, cloud-drive links, and URLs requiring credentials or headers are unsupported. ### 3. Run the document-conformance check Tell the user that fetching and validating the live document can take up to 60 seconds. Call `powmcp-sbom-preflight:sbom_check` once with `url` or `file`. ``` `SKILL.md:115-117` ```markdown For before-and-after or baseline-and-candidate evidence, call `powmcp-sbom-preflight:sbom_compare` with exactly two distinct public URLs or exactly two distinct attached files, in baseline then candidate order. Tell the user that fetching and validating two live documents can take up to 60 seconds. If set, `maxDefects` must be an integer from 1 to 500; its default is 200. Correct an invalid field and retry. Duplicate builds are an argument failure, not comparison evidence. ``` `agents/openai.yaml:7-13` ```yaml dependencies: tools: - type: "mcp" value: "powmcp-sbom-preflight" description: "SBOM Check (PowMCP)" transport: "streamable_http" url: "https://powmcp.com/sbom-preflight/mcp" ``` `references/sbom-preflight.md:17-35` ```markdown ### `powmcp-sbom-preflight:sbom_check` Choose exactly one source kind: - `url`: one publicly fetchable HTTP(S) document. - `file`: one SBOM file attached in the conversation. Do not provide both. The source limit is 10 MB. ...[truncated 3022 chars]
• Remediation: ## Remediation Suggestions 1. Before any attached file is sent, display an explicit notice identifying: - The destination domain. - That the complete SBOM contents will leave the current session. - The categories of metadata an SBOM may reveal. - Applicable retention, logging, privacy, and deletion terms. 2. Require affirmative user consent immediately before invoking the remote MCP with an attached file. Do not infer consent merely from attachment. 3. Default confidential, internal, or pre-release SBOMs to the documented local or CI validation path. 4. Disable implicit invocation for workflows that can upload files, or require a confirmation gate after implicit selection and before transmission. 5. Support data minimization where technically possible, such as local schema validation or explicitly approved redacted artifacts. 6. Document the remote service's data-processing boundaries, subprocessors, retention period, encryption controls, and deletion procedure. 7. Continue suppressing credentials and URL query strings, but clarify that this protection does not prevent disclosure of sensitive information contained inside the SBOM itself.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:36
• Finding: Installation command executes an unpinned third-party package## Vulnerability Details **File Location**: `SKILL.md:36-39` **Vulnerability Type**: Unpinned executable installation dependency **Risk Level**: Medium **Relevant code snippet:** ```markdown ## Connect once ``` npx skills add powmcp/skills --skill attach-regulator-ready-bom-to-release ``` ``` ### Technical Analysis The installation instructions invoke `npx skills` without specifying an exact package version or integrity digest. Depending on the local npm and `npx` configuration, this can retrieve and execute the package version currently resolved from the configured registry. Because the executable dependency is not pinned, the code run by future users can differ from the code considered during this audit. A compromised publisher account, registry compromise, malicious dependency update, or unexpected upstream release could therefore alter installation behavior after review. This is a supply-chain weakness rather than evidence that the current package is malicious. The audited project contains no embedded malicious script, but the installation command creates a mutable remote execution boundary. ### Attack Path 1. An attacker compromises the publisher, package, registry, or an upstream dependency used by the unpinned `skills` package. 2. The attacker publishes a modified release that is selected by the unversioned package resolution. 3. A user follows the documented `npx skills add ...` instruction. 4. `npx` downloads and executes the attacker-controlled package version. 5. The malicious package runs with the permissions of the user executing the command. 6. It may access files and credentials available to that user, alter development configuration, install additional components, or execute arbitrary commands. ### Impact Assessment Successful exploitation could provide arbitrary code execution with the installing user's privileges. The accessible scope may include source repositories, environment variables ...[truncated 325 chars]
• Remediation: ## Remediation Suggestions 1. Pin the installation utility to an audited exact version, for example by using an exact package version rather than a floating package name. 2. Publish and verify an integrity digest or signed release artifact for the installer. 3. Document the expected npm registry, package scope, publisher identity, and signature-verification process. 4. Supply a lockfile or reproducible installation method that fixes transitive dependency versions. 5. Configure automated dependency review and alerting for publisher changes, integrity changes, and newly disclosed vulnerabilities. 6. Advise users not to execute the installation command with administrator privileges. 7. Re-audit package updates before changing the pinned version.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (3)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 87% confidence
• Finding: The skill instructs users to install and trust a remote package/toolchain via `npx skills add powmcp/skills` without pinning an immutable version. This creates a supply-chain risk: future upstream changes, account compromise, or dependency poisoning could alter what gets executed at install/use time and expose users to unintended code or behavior.

Unbounded Output

Medium

• Category: Output Handling

Content

Record the checked input identity and date. Quote measured findings without recalculating, rounding, or embellishing them.

Before calling the artifact accepted, require `pass: true` with no truncation marker for supported JSON or separately recorded evidence from the non-PowMCP validation path for XML or tag-value, a detected version at or above the applicable BSI floor, completed separate supplier-coverage and recursive-resolution reviews, and completed conformity work. List what was not checked and why and state what the result does not prove. If a required gate failed or remains unassessable, report the blocker without labeling or attaching the artifact as accepted; otherwise attach it to the release.

## Reading results

• Confidence: 60% confidence
• Finding: Output size or generation rate is not bounded. Unbounded output enables denial-of-service through resource exhaustion, log flooding, or context-window stuffing.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The skill enables implicit invocation without constraining when it may be auto-selected, which can cause the agent to invoke an external SBOM-checking MCP service in situations the user did not explicitly request. Because this skill is release-gating and sends data to a remote tool endpoint, unintended invocation can expose sensitive release metadata or trigger compliance decisions based on irrelevant context.

Static analysis

No suspicious patterns detected.