Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 91% confidence
- Finding
- The skill instructs users to run `npx skills add ...` without pinning an immutable version or commit. That allows the fetched package or installer behavior to change over time, creating a supply-chain risk where a compromised or newly published package version could execute unintended code in the agent environment.
