Client Site Handoff Report

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 9:48 PM UTC
• Version: 1.0.0

Overview

This skill is a disclosed handoff-report workflow that checks public page links through a remote PowMCP service, with install and implicit-use cautions but no evidence of hidden or harmful behavior.

Install only if you are comfortable connecting a remote PowMCP link-checking service and sending it the public page URL being reviewed. Avoid private, authenticated, or secret-bearing URLs; verify or pin the npx installer/source if your environment requires stronger supply-chain controls; remove the MCP connection later if you do not want it available for future sessions.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:35

Finding

Unpinned Package Execution Through npx

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 35
Vulnerability Type: Supply-chain risk caused by an unpinned executable dependency
Risk Level: Medium

Vulnerable Code

sh

npx skills add powmcp/skills --skill produce-client-site-handoff-report

Technical Analysis

The documented installation command invokes npx without pinning the skills package to a reviewed version or integrity hash. Depending on the local package-manager state, npx can download the package from the configured registry and execute its current release.

This creates a mutable execution boundary: the code run by a user may differ from the code that existed when this Skill was reviewed. Compromise of the package, its publisher account, or the configured package registry could therefore introduce attacker-controlled installation behavior.

The issue is limited to users who run this installation command. The audit found no evidence that the Skill silently invokes the command, and no bundled malicious script was identified.

Attack Path

1. An attacker compromises the package publisher, package distribution channel, or registry resolution path for the unversioned skills package.
2. The attacker publishes a malicious release or causes the package name to resolve to attacker-controlled content.
3. A user follows SKILL.md and runs the documented npx skills add ... command.
4. npx retrieves the current, unreviewed package release.
5. Package entry-point or installation code executes with the privileges of the invoking user.
6. The malicious package can access resources available to that user and modify files permitted by the user's operating-system permissions.

Impact Assessment

Successful exploitation could provide arbitrary code execution under the invoking user's account. The resulting scope could include reading or changing user-accessible files, accessing credentials exposed to the process, modifying local development configuration, or i ...[truncated 656 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the executable package to a specific, reviewed version, for example by using the package manager's exact-version syntax rather than resolving the latest release.
2. Use a lockfile and verified integrity metadata where supported.
3. Document the exact expected registry and package identity to reduce dependency-confusion and registry-substitution risk.
4. Prefer a reviewed local installation over automatic download-and-execute behavior.
5. Instruct users to inspect the resolved package version and provenance before running it.
6. Establish a controlled update process in which new dependency versions are reviewed and tested before the documented pin is changed.
7. Avoid recommending elevated execution and explicitly state that the installation command should run with ordinary user privileges.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

The skill instructs users to run npx skills add powmcp/skills --skill produce-client-site-handoff-report without pinning an exact package version. That allows whatever version is current at execution time to be fetched and run, creating a supply-chain risk if the package is updated maliciously or unexpectedly changed.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill enables allow_implicit_invocation without defining any trigger constraints or exclusions, which increases the chance that the agent invokes an external MCP service in situations the user did not explicitly request. Because this skill reaches out to a remote link-checking service, implicit activation can cause unintended external network access, transmission of site URLs or related context, and tool use outside the intended handoff-review workflow.

Content

No source excerpt is available for this finding.