max-throughput

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:25 AM UTC
• Version: 1.0.0

Overview

This skill is coherent for throughput tuning, but it needs review because it broadly encourages aggressive parallel execution, global/persistent agent behavior, and unpinned package/tool execution that can affect the user's machine or shared systems.

Review this skill before installing on shared, production, CI, or quota-limited machines. Prefer manual installation or pinned package commands, avoid approving unexpected `npx` or `pip` downloads, and require user confirmation before launching parallel jobs, bulk downloads, MPS, or commands intended to consume all available CPU/GPU capacity.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T08 · Insecure Dependencies

Warning

• Location: README.md:22

Finding

Unpinned Skills CLI Download and Execution

Content

View full analysis

Vulnerability Details

File Location: README.md, lines 22-23
Vulnerability Type: Unpinned third-party package execution
Risk Level: Medium

Vulnerable Code

bash

npx skills add Promethe-us/max-throughput -g -a cursor
npx skills add Promethe-us/max-throughput -g -a codex

Technical Analysis

These installation instructions invoke the skills npm package through npx without specifying an exact, reviewed version. If the package is not already available locally, npx can retrieve it from the configured npm registry and execute it immediately. The effective code therefore may change after this Skill has been reviewed.

This creates a supply-chain trust boundary that is not disclosed or constrained by a lockfile, integrity hash, exact version, or trusted-registry requirement. The -g option also performs a global Skill installation, potentially changing persistent agent configuration.

No evidence was found that the currently referenced package is malicious. The vulnerability is the unsafe, mutable dependency retrieval mechanism.

Attack Path

1. An attacker compromises the upstream skills package, its maintainer account, its release process, or the registry resolution path.
2. The attacker publishes a malicious version under the expected package name.
3. A user follows the documented unpinned npx skills add command.
4. npx resolves and downloads the attacker-controlled release.
5. Package code or installation hooks execute with the user's privileges.
6. The malicious package can access files available to that user and may modify globally installed agent Skills or configuration.

Impact Assessment

Successful exploitation could obtain arbitrary code execution with the privileges of the user running the installation. The accessible scope may include source repositories, user-readable credentials, agent configuration, and globally installed Skills. Administrative or root privileg ...[truncated 89 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the CLI to an exact, reviewed version, for example npx skills@1.2.3 add ....
• Prefer npx --no-install when an audited local installation is expected.
• Document the expected registry and advise users to reject unexpected download prompts.
• Publish and verify package integrity information, such as an npm lockfile or release checksums.
• Recommend manual installation from a reviewed release archive as the security-sensitive alternative.
• Avoid running installation commands with elevated privileges.

T08 · Insecure Dependencies

Warning

• Location: references/cpu-parallelism.md:44

Finding

Unpinned Test Tool Execution Through npx

Content

View full analysis

Vulnerability Details

File Location: references/cpu-parallelism.md, lines 44-45
Vulnerability Type: Unpinned third-party package execution
Risk Level: Medium

Vulnerable Code

bash

npx jest --maxWorkers="75%"
npx vitest --pool=threads --poolSize="$(nproc)"

Technical Analysis

The playbook recommends invoking jest and vitest through npx without requiring a locally locked dependency or specifying an exact package version. When these packages are absent locally, npx may retrieve and execute packages from the configured npm registry.

Consequently, the code executed by these commands is not fully determined by the audited Skill. Registry compromise, maintainer-account compromise, dependency confusion caused by registry configuration, or a malicious future release could turn an ordinary performance command into arbitrary local code execution.

No malicious package or deliberate remote payload was identified in the project itself. The issue is the lack of dependency pinning and provenance controls.

Attack Path

1. The target project does not contain a locally installed, lockfile-pinned copy of Jest or Vitest.
2. An attacker compromises the relevant upstream package, release account, dependency chain, or registry resolution path.
3. A user or agent follows the playbook and runs one of the npx commands.
4. npx downloads the compromised package or dependency.
5. The downloaded JavaScript package executes with the invoking user's permissions.
6. The payload can read or modify the current repository and other user-accessible resources.

Impact Assessment

Exploitation could provide arbitrary code execution as the invoking user. This may expose source code, test secrets, environment variables, package-manager credentials, and other files readable by that user. It may also permit modification of the working tree or user-level development configuration. The commands do not inherent ...[truncated 36 chars]

Remediation

View remediation

Remediation Suggestions

• Require Jest and Vitest to be declared at exact reviewed versions in the project's development dependencies.
• Commit and enforce a package-manager lockfile.
• Invoke locked local binaries through package scripts or use npx --no-install.
• Use reproducible installation modes such as npm ci.
• Restrict package installation to an approved registry and enable package-integrity and provenance verification.
• Clarify that agents must not automatically approve an npx download prompt.

T08 · Insecure Dependencies

Warning

• Location: references/profiling.md:85

Finding

Unpinned py-spy Installation

Content

View full analysis

Vulnerability Details

File Location: references/profiling.md, line 85
Vulnerability Type: Unpinned Python package installation
Risk Level: Medium

Vulnerable Code

bash

pip install py-spy

Technical Analysis

The profiling guide installs py-spy without pinning an exact version, requiring hashes, using a lockfile, or constraining the package index. Python package installation can execute package build logic when a source distribution is selected, while installed profiler binaries subsequently execute native code with the user's privileges.

The package retrieved at execution time can differ from the version available when the Skill was audited. A compromised package release, dependency, package-index account, or registry configuration could therefore introduce arbitrary code.

The audit found no evidence that py-spy itself is malicious. The finding concerns mutable and insufficiently verified dependency installation.

Attack Path

1. An attacker compromises the py-spy distribution channel, maintainer account, dependency chain, or the package index configured on the target.
2. The attacker publishes or serves a malicious distribution.
3. A user follows the guide and executes pip install py-spy.
4. Pip downloads the malicious distribution; build hooks may execute during installation, or the malicious profiler executes when invoked.
5. The payload runs with the permissions of the invoking user and can access user-readable files and processes.

Impact Assessment

Successful exploitation could result in arbitrary code execution as the installing user. The exposed scope may include the current source repository, environment variables, Python or package-index credentials, and processes accessible to the user. Because a profiler is intended to inspect another process, a compromised profiler may also access data available through user-authorized process-inspection facilities. No privileg ...[truncated 99 chars]

Remediation

View remediation

Remediation Suggestions

• Pin py-spy to an exact reviewed version.
• Place the dependency in a locked requirements file.
• Require package hashes with pip install --require-hashes.
• Prefer reviewed binary wheels and disable unexpected source builds where practical.
• Configure pip to use an approved package index and verify release provenance.
• Install into an isolated virtual environment without administrative privileges.
• Separate installation from profiler execution so users can review the resolved artifact first.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (11)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The code partially matches the description because it does inspect CPU, memory, and GPU resources and suggests parallelization settings. However, the declared purpose is substantially broader and centers on optimizing long-running compute jobs by profiling real execution to identify true bottlenecks and then tuning workload-specific parameters. This script does not run, monitor, or profile any job; it does not measure data pipeline, CPU decode, GPU compute, I/O, or VRAM bottlenecks; and it does not adjust training/evaluation parameters like batch size or precision. Its actual primary purpose is a static hardware/resource report with simple heuristics. That is a materially narrower behavior than the declared description, so this should be flagged as a mismatch.

Content

No source excerpt is available for this finding.

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 86% confidence

Finding

cat urls.txt | xargs -P 8 -n 1 curl -LO performs concurrent downloads from every entry in an input file with no validation of scheme, host, or destination safety. In a high-throughput skill focused on aggressive parallelism, this pattern increases the risk of mass-fetching attacker-controlled URLs, enabling SSRF-like access paths, uncontrolled network egress, or downloading malicious content at scale.

Content

Scanner excerpt · references/cpu-parallelism.md (reported line 88)May include surrounding context.

bash

aria2c -x 16 -s 16 -i urls.txt          # multi-connection per file
cat urls.txt | xargs -P 8 -n 1 curl -LO # many files concurrently

Verification

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The README instructs users to run npx skills add ... without pinning an exact package version. Because npx resolves and executes the latest matching package from the registry at runtime, a compromised or malicious update to the skills package could result in arbitrary code execution on the user's machine during installation.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

This command repeats the same unpinned npx skills installation pattern, which causes execution of a package version selected at runtime rather than a reviewed, fixed release. If the upstream package or dependency chain is hijacked, users following the README could execute attacker-controlled code during setup.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill repeatedly instructs the agent to execute shell commands such as Python scripts, nvidia-smi, make, pytest, and parallelized job launchers, but it declares no tool restrictions or permissions boundary. That creates an authorization gap where a broadly activated skill may cause shell execution in environments where such capability was not explicitly scoped or reviewed.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The activation condition is extremely broad, covering many common engineering and research tasks, which increases the chance the skill is invoked in situations where aggressive parallelism and shell-driven optimization are inappropriate. In practice, over-broad routing can trigger unnecessary command execution, heavy resource consumption, or interference with shared systems outside the user's actual intent.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/inspect_resources.py (reported line 23)May include surrounding context.

python

def run_command(command: list[str], timeout: float = 10.0) -> str:
    """Run a command and return stripped stdout, or empty string on failure."""
    try:
        completed = subprocess.run(
            command,
            capture_output=True,
            text=True,

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/quick_triage.py (reported line 27)May include surrounding context.

python

def run_command(command: list[str], timeout: float = 5.0) -> str:
    try:
        completed = subprocess.run(
            command, capture_output=True, text=True, timeout=timeout,
            encoding="utf-8", errors="replace",
        )

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

This markdown file provides commands for running many parallel GPU jobs and starting nvidia-cuda-mps-control -d, which can materially affect shared system resources and other workloads. While the document explains how to do this, it does not include a clear warning that these actions may impact other users, monopolize GPUs, or require appropriate permissions on shared machines.

Content

No source excerpt is available for this finding.