max-throughput

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:25 AM UTC
• Version: 1.0.0

Overview

This skill is coherent for throughput tuning, but it needs review because it broadly encourages aggressive parallel execution, global/persistent agent behavior, and unpinned package/tool execution that can affect the user's machine or shared systems.

Review this skill before installing on shared, production, CI, or quota-limited machines. Prefer manual installation or pinned package commands, avoid approving unexpected `npx` or `pip` downloads, and require user confirmation before launching parallel jobs, bulk downloads, MPS, or commands intended to consume all available CPU/GPU capacity.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T08 · Insecure Dependencies

Warning

• Location: README.md:22
• Finding: Unpinned Skills CLI Download and Execution## Vulnerability Details **File Location**: `README.md`, lines 22-23 **Vulnerability Type**: Unpinned third-party package execution **Risk Level**: Medium ### Vulnerable Code ```bash npx skills add Promethe-us/max-throughput -g -a cursor npx skills add Promethe-us/max-throughput -g -a codex ``` ### Technical Analysis These installation instructions invoke the `skills` npm package through `npx` without specifying an exact, reviewed version. If the package is not already available locally, `npx` can retrieve it from the configured npm registry and execute it immediately. The effective code therefore may change after this Skill has been reviewed. This creates a supply-chain trust boundary that is not disclosed or constrained by a lockfile, integrity hash, exact version, or trusted-registry requirement. The `-g` option also performs a global Skill installation, potentially changing persistent agent configuration. No evidence was found that the currently referenced package is malicious. The vulnerability is the unsafe, mutable dependency retrieval mechanism. ### Attack Path 1. An attacker compromises the upstream `skills` package, its maintainer account, its release process, or the registry resolution path. 2. The attacker publishes a malicious version under the expected package name. 3. A user follows the documented unpinned `npx skills add` command. 4. `npx` resolves and downloads the attacker-controlled release. 5. Package code or installation hooks execute with the user's privileges. 6. The malicious package can access files available to that user and may modify globally installed agent Skills or configuration. ### Impact Assessment Successful exploitation could obtain arbitrary code execution with the privileges of the user running the installation. The accessible scope may include source repositories, user-readable credentials, agent configuration, and globally installed Skills. Administrative or root privileg ...[truncated 89 chars]
• Remediation: ## Remediation Suggestions - Pin the CLI to an exact, reviewed version, for example `npx skills@1.2.3 add ...`. - Prefer `npx --no-install` when an audited local installation is expected. - Document the expected registry and advise users to reject unexpected download prompts. - Publish and verify package integrity information, such as an npm lockfile or release checksums. - Recommend manual installation from a reviewed release archive as the security-sensitive alternative. - Avoid running installation commands with elevated privileges.

T08 · Insecure Dependencies

Warning

• Location: references/cpu-parallelism.md:44
• Finding: Unpinned Test Tool Execution Through npx## Vulnerability Details **File Location**: `references/cpu-parallelism.md`, lines 44-45 **Vulnerability Type**: Unpinned third-party package execution **Risk Level**: Medium ### Vulnerable Code ```bash npx jest --maxWorkers="75%" npx vitest --pool=threads --poolSize="$(nproc)" ``` ### Technical Analysis The playbook recommends invoking `jest` and `vitest` through `npx` without requiring a locally locked dependency or specifying an exact package version. When these packages are absent locally, `npx` may retrieve and execute packages from the configured npm registry. Consequently, the code executed by these commands is not fully determined by the audited Skill. Registry compromise, maintainer-account compromise, dependency confusion caused by registry configuration, or a malicious future release could turn an ordinary performance command into arbitrary local code execution. No malicious package or deliberate remote payload was identified in the project itself. The issue is the lack of dependency pinning and provenance controls. ### Attack Path 1. The target project does not contain a locally installed, lockfile-pinned copy of Jest or Vitest. 2. An attacker compromises the relevant upstream package, release account, dependency chain, or registry resolution path. 3. A user or agent follows the playbook and runs one of the `npx` commands. 4. `npx` downloads the compromised package or dependency. 5. The downloaded JavaScript package executes with the invoking user's permissions. 6. The payload can read or modify the current repository and other user-accessible resources. ### Impact Assessment Exploitation could provide arbitrary code execution as the invoking user. This may expose source code, test secrets, environment variables, package-manager credentials, and other files readable by that user. It may also permit modification of the working tree or user-level development configuration. The commands do not inherent ...[truncated 36 chars]
• Remediation: ## Remediation Suggestions - Require Jest and Vitest to be declared at exact reviewed versions in the project's development dependencies. - Commit and enforce a package-manager lockfile. - Invoke locked local binaries through package scripts or use `npx --no-install`. - Use reproducible installation modes such as `npm ci`. - Restrict package installation to an approved registry and enable package-integrity and provenance verification. - Clarify that agents must not automatically approve an `npx` download prompt.

T08 · Insecure Dependencies

Warning

• Location: references/profiling.md:85
• Finding: Unpinned py-spy Installation## Vulnerability Details **File Location**: `references/profiling.md`, line 85 **Vulnerability Type**: Unpinned Python package installation **Risk Level**: Medium ### Vulnerable Code ```bash pip install py-spy ``` ### Technical Analysis The profiling guide installs `py-spy` without pinning an exact version, requiring hashes, using a lockfile, or constraining the package index. Python package installation can execute package build logic when a source distribution is selected, while installed profiler binaries subsequently execute native code with the user's privileges. The package retrieved at execution time can differ from the version available when the Skill was audited. A compromised package release, dependency, package-index account, or registry configuration could therefore introduce arbitrary code. The audit found no evidence that `py-spy` itself is malicious. The finding concerns mutable and insufficiently verified dependency installation. ### Attack Path 1. An attacker compromises the `py-spy` distribution channel, maintainer account, dependency chain, or the package index configured on the target. 2. The attacker publishes or serves a malicious distribution. 3. A user follows the guide and executes `pip install py-spy`. 4. Pip downloads the malicious distribution; build hooks may execute during installation, or the malicious profiler executes when invoked. 5. The payload runs with the permissions of the invoking user and can access user-readable files and processes. ### Impact Assessment Successful exploitation could result in arbitrary code execution as the installing user. The exposed scope may include the current source repository, environment variables, Python or package-index credentials, and processes accessible to the user. Because a profiler is intended to inspect another process, a compromised profiler may also access data available through user-authorized process-inspection facilities. No privileg ...[truncated 99 chars]
• Remediation: ## Remediation Suggestions - Pin `py-spy` to an exact reviewed version. - Place the dependency in a locked requirements file. - Require package hashes with `pip install --require-hashes`. - Prefer reviewed binary wheels and disable unexpected source builds where practical. - Configure pip to use an approved package index and verify release provenance. - Install into an isolated virtual environment without administrative privileges. - Separate installation from profiler execution so users can review the resolved artifact first.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (11)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The code partially matches the description because it does inspect CPU, memory, and GPU resources and suggests parallelization settings. However, the declared purpose is substantially broader and centers on optimizing long-running compute jobs by profiling real execution to identify true bottlenecks and then tuning workload-specific parameters. This script does not run, monitor, or profile any job; it does not measure data pipeline, CPU decode, GPU compute, I/O, or VRAM bottlenecks; and it does not adjust training/evaluation parameters like batch size or precision. Its actual primary purpose is a static hardware/resource report with simple heuristics. That is a materially narrower behavior than the declared description, so this should be flagged as a mismatch.

Chaining Abuse

High

• Category: Tool Misuse

Content

```bash
aria2c -x 16 -s 16 -i urls.txt          # multi-connection per file
cat urls.txt | xargs -P 8 -n 1 curl -LO # many files concurrently
```

## Verification

• Confidence: 86% confidence
• Finding: `cat urls.txt | xargs -P 8 -n 1 curl -LO` performs concurrent downloads from every entry in an input file with no validation of scheme, host, or destination safety. In a high-throughput skill focused on aggressive parallelism, this pattern increases the risk of mass-fetching attacker-controlled URLs, enabling SSRF-like access paths, uncontrolled network egress, or downloading malicious content at scale.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence
• Finding: The README instructs users to run `npx skills add ...` without pinning an exact package version. Because `npx` resolves and executes the latest matching package from the registry at runtime, a compromised or malicious update to the `skills` package could result in arbitrary code execution on the user's machine during installation.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence
• Finding: This command repeats the same unpinned `npx skills` installation pattern, which causes execution of a package version selected at runtime rather than a reviewed, fixed release. If the upstream package or dependency chain is hijacked, users following the README could execute attacker-controlled code during setup.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill repeatedly instructs the agent to execute shell commands such as Python scripts, nvidia-smi, make, pytest, and parallelized job launchers, but it declares no tool restrictions or permissions boundary. That creates an authorization gap where a broadly activated skill may cause shell execution in environments where such capability was not explicitly scoped or reviewed.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The activation condition is extremely broad, covering many common engineering and research tasks, which increases the chance the skill is invoked in situations where aggressive parallelism and shell-driven optimization are inappropriate. In practice, over-broad routing can trigger unnecessary command execution, heavy resource consumption, or interference with shared systems outside the user's actual intent.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

def run_command(command: list[str], timeout: float = 10.0) -> str:
    """Run a command and return stripped stdout, or empty string on failure."""
    try:
        completed = subprocess.run(
            command,
            capture_output=True,
            text=True,

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

def run_command(command: list[str], timeout: float = 5.0) -> str:
    try:
        completed = subprocess.run(
            command, capture_output=True, text=True, timeout=timeout,
            encoding="utf-8", errors="replace",
        )

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Missing User Warnings

Low

• Confidence: 79% confidence
• Finding: This markdown file provides commands for running many parallel GPU jobs and starting `nvidia-cuda-mps-control -d`, which can materially affect shared system resources and other workloads. While the document explains how to do this, it does not include a clear warning that these actions may impact other users, monopolize GPUs, or require appropriate permissions on shared machines.

Static analysis

No suspicious patterns detected.