Published release gate

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:52 PM UTC
• Version: 1.0.0

Overview

The skill’s purpose is coherent, but its setup asks users to run an unpinned npx installer that can execute mutable remote code before the reviewed skill is installed.

Review the setup step before installing. Prefer a pinned installer version or a commit-pinned, integrity-verified installation path, and run any installer from a least-privileged environment without unrelated secrets. The actual skill instructions are otherwise scoped to public npm package checks and do not show destructive or hidden behavior.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:42

Finding

Unpinned npx Package Execution Creates a Mutable Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 42
Vulnerability Type: Unpinned third-party package execution
Risk Level: Medium

Vulnerable Code

sh

npx skills add powmcp/skills --skill gate-published-release-before-announcement

Technical Analysis

The documented installation command invokes the third-party skills package through npx without specifying an exact package version or integrity value. If the package is absent locally, npx may retrieve its currently published release and execute its command-line entry point.

Because the dependency is mutable, the code executed when a user follows this instruction can differ from the code that was available when this Skill was audited. The powmcp/skills repository reference is also not tied to an immutable commit, further reducing reproducibility.

This exceeds the minimum behavior necessary to install static Skill content because installation depends on executing remotely maintained code whose future contents are not constrained by the audited project.

Attack Path

1. An attacker compromises the npm account, publishing process, or upstream source associated with the unpinned skills package.
2. The attacker publishes a modified version containing a malicious command-line payload.
3. A user follows the installation command from SKILL.md.
4. npx resolves and downloads the attacker-controlled current package version.
5. The package entry point executes under the invoking user's account.
6. The payload can access resources available to that user, subject to operating-system permissions and environmental restrictions.

Compromise of the mutable repository reference could also cause unexpected Skill content to be installed, depending on how the external installer retrieves and processes that repository.

Impact Assessment

Successful exploitation of the npx execution path could run arbitrary code with the privileges of ...[truncated 463 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the installer to an explicitly reviewed package version, for example by using an exact version rather than the latest available release.
2. Pin the referenced repository to an immutable commit identifier instead of a mutable owner/repository reference, if the installer supports commit-qualified sources.
3. Verify package integrity through a lockfile, cryptographic digest, signed release, or equivalent trusted-publishing mechanism.
4. Prefer an installation method that copies reviewed static Skill files without executing a remotely downloaded package.
5. Document the expected package version, repository commit, file inventory, and verification procedure so users can reproduce the reviewed installation.
6. Run any unavoidable installer in a least-privileged, isolated environment without unrelated credentials or sensitive environment variables.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The skill instructs users to run npx skills add powmcp/skills --skill gate-published-release-before-announcement without pinning an exact package version. Because npx resolves the latest published package at execution time, a compromised or maliciously updated package could be fetched and executed, creating a supply-chain risk for anyone following the setup step.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.