Weekly episode feed gate

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 9:48 PM UTC
• Version: 1.0.0

Overview

This skill is a disclosed podcast feed validation helper that uses a third-party MCP service on public podcast URLs, with supply-chain and remote-service cautions but no evidence of malicious behavior.

Before installing, be aware that the setup command can fetch current third-party code and that checks send public podcast feed or media URLs to PowMCP for live validation. Use pinned or reviewed installation sources in sensitive environments, and avoid submitting private feeds or secret-bearing URLs unless you are comfortable with that service receiving them.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:37
• Finding: Unpinned Third-Party Installer and Mutable Skill Source<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, line 37 **Vulnerability Type**: Unpinned third-party dependency execution **Risk Level**: Medium ### Vulnerable Code ```sh npx skills add powmcp/skills --skill publish-weekly-episode-without-feed-breakage ``` ### Technical Analysis The documented installation command invokes `npx` without pinning the `skills` package to a reviewed version and identifies `powmcp/skills` without an immutable version or commit hash. Consequently, the components resolved when a user runs this command may differ from those available when the Skill was audited. Because `npx` can download and execute package code, compromise of the package registry entry, publisher account, or referenced upstream Skill repository could cause users to execute altered installer or dependency code. This is a supply-chain weakness rather than evidence that the currently reviewed project contains malicious code. ### Attack Path 1. An attacker compromises the publisher account, package source, distribution channel, or mutable `powmcp/skills` repository. 2. The attacker publishes a modified version containing malicious installation behavior. 3. A user follows the documented unpinned `npx` installation command. 4. The package manager resolves the attacker-controlled version rather than a previously reviewed release. 5. Malicious code executes with the permissions of the user running the command. Successful exploitation depends on compromise or malicious modification of an upstream source. ### Impact Assessment The command may execute downloaded code with the invoking user's privileges. Depending on those privileges and the malicious payload, impact could include: - Reading or modifying files accessible to the user. - Accessing credentials or tokens available to the process. - Modifying development configuration or installed Skills. - Running additional commands or downloading further payloads. - Compromising projects and sessions o ...[truncated 183 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin the `skills` CLI package to a specific reviewed version: ```sh npx skills@<reviewed-version> add ... ``` 2. Pin `powmcp/skills` to an immutable release tag or, preferably, a verified commit hash. 3. Publish and verify cryptographic integrity hashes or signed release provenance for distributed packages. 4. Use lockfiles where the installation workflow supports them and require reproducible dependency resolution. 5. Document the expected package publisher, source repository, release identifier, and checksum so users can verify authenticity before execution. 6. Avoid automatic execution of newly resolved dependencies. Download and inspect the package first in sensitive environments, or run installation in a restricted sandbox with no secrets and minimal filesystem access. 7. Establish dependency update review procedures so version changes receive security review before documentation is updated. ]]>

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence
• Finding: The skill instructs users to run `npx skills add powmcp/skills --skill publish-weekly-episode-without-feed-breakage` without pinning an exact package version. This allows the fetched package or its transitive dependencies to change over time, creating a supply-chain risk where a compromised or malicious later release could execute code on the user's machine during installation or use.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The skill enables allow_implicit_invocation without any visible trigger constraints, so the agent may invoke this external MCP tool in broader situations than intended. Because the tool reaches a third-party network endpoint, ambiguous activation increases the chance of unreviewed external requests, unintended data exposure in URLs or prompts, and surprise behavior during ordinary conversations.

Static analysis

No suspicious patterns detected.