Security audit

generation-diversity

Security checks for vulnerabilities and agentic risk

Overview

This is a documentation-only guide for varied media prompts and review gates, with caution mainly around unpinned install examples and demographic or voice choices.

Use this as a prompt and QA playbook, not as authority to spend credits or upload files without your approval. Before running the documented `npx` install commands, verify the publisher and prefer pinned or reviewed versions when available. For cast, gender, ethnicity, and voice guidance, make explicit creative choices rather than letting the agent infer sensitive traits from appearance.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (15)

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The skill instructs users to run npx skills add ... from a mutable package source without pinning an exact package version or immutable artifact. If the upstream package, tag, or dependency chain is compromised, users may execute attacker-controlled code during installation. Because this is an installation command embedded in a skill document, it creates a direct software supply-chain risk rather than a purely informational issue.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: This line recommends installing another skill via npx skills add ... using a tag-like reference instead of an immutable pinned version. An attacker who can alter the referenced package or its transitive dependencies could cause arbitrary code execution on the user's machine at install time. The fact that it appears in a related-skills section does not reduce the underlying supply-chain exposure.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The documented install command relies on npx with a non-immutable package reference, which can pull and execute changed code over time. If the package source is hijacked, typo-squatted, or maliciously updated, users following the documentation may run untrusted code. This is a classic dependency/supply-chain weakness in install instructions.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: This install example again uses npx skills add ... without an immutable version constraint, leaving consumers exposed to upstream changes. Documentation that normalizes executing remote package manager commands without pinning increases the chance of successful supply-chain compromise. The danger is installation-time code execution, not just receiving different content.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The skill suggests installing a package through npx with a mutable reference, which can resolve to different code later. Because package manager install flows commonly execute lifecycle scripts or fetched code, compromise of the package or its dependencies could lead to arbitrary command execution on the user's environment. In a security review, this is a real supply-chain risk.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The command on this line references a remotely resolved package/tag via npx skills add instead of a fully pinned immutable version. This exposes users to package substitution or malicious updates, which is especially risky because install commands are likely to be copied verbatim. The skill context makes the issue more dangerous because it is packaged as operational guidance for agents and users.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: This line continues the same pattern of unpinned npx-based installation instructions. Mutable package references create a window where the installed code can differ from what the document author reviewed, enabling supply-chain attacks. The vulnerability is documentation-induced unsafe execution of remote code.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The install example uses an unpinned package source via npx, which means future installs may fetch different code than intended. If the upstream account, package, or dependency graph is compromised, the user may run malicious code simply by following the documentation. That makes this a true positive supply-chain vulnerability.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: This command documents execution of a remotely resolved package without exact pinning. Such patterns are dangerous because npx may download and run package code immediately, and mutable references permit attacker-controlled changes after publication. In context, the skill serves as a reusable instruction set, increasing propagation of the unsafe practice.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The line contains another unpinned npx skills add install instruction, which is vulnerable to supply-chain compromise through malicious package updates or dependency poisoning. Because the command is meant to be executed directly, the practical consequence is arbitrary code execution at install time. This is more than a style issue; it is a real operational security concern.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: This install recommendation does not pin the remotely executed package to an immutable version. As a result, anyone following it may execute code that has changed since the document was authored or reviewed, enabling compromise through registry, maintainer, or dependency attacks. The repeated pattern suggests weak supply-chain hygiene rather than malicious intent.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 96% confidence
Finding: The 'full suite' install command again uses npx skills add ... with a mutable target, magnifying the risk because it may install a larger set of code and dependencies in one step. If the package or any transitive component is compromised, the user can be exposed to arbitrary code execution during installation. The broader install scope slightly increases blast radius compared with a single smaller component.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The skill explicitly directs agents to alternate persona gender and use matching male/female voice presets, which bakes sensitive-attribute inference and gender-essentialist behavior into the workflow without user opt-in. In production, this can cause misgendering, discriminatory personalization, or inappropriate handling of identity attributes, especially when voices or face/identity transformations are applied automatically.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The manifest describes a skill for prompt diversity and quality gates before paid API calls. This checklist item instructs users to decide whether to add an instrumental bed under dialogue using a separate audio model and volume settings, which is a delivery/post-production concern rather than prompt-diversity guidance.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The manifest description frames this skill as prompt-writing guidance focused on ritual seed, structure, scenario axes, and quality gates before API use. In the file, the guidance expands beyond prompt preparation into operational recordkeeping and manifest instrumentation, including logging identifiers and plan metadata, which is broader than the stated purpose.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.