Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 91% confidence
- Finding
- The skill instructs agents to install and execute additional skills via `npx skills add ...` using floating package refs rather than immutable, cryptographically pinned artifacts. This creates a supply-chain risk: if the referenced package, tag, or transitive installer behavior changes, an agent may fetch and run unexpected code or altered prompts during execution.
