Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 92% confidence
- Finding
- The skill instructs users to run `npx skills add ...` commands without pinning the `skills` loader itself to a specific version. This creates a supply-chain risk because the fetched tooling may change over time or be replaced upstream, leading to execution of unexpected code during install.
