intent-framed-agents

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:07 AM UTC
• Version: 1.0.0

Overview

The skill itself is a lightweight prompt-only workflow, but its install instructions use unpinned third-party commands that can install mutable or broader content than the reviewed file.

Review the exact source before installing, prefer a pinned commit or release for both the skill source and package runner, and use the specific skill path rather than the whole-repository install unless you intend to add all skills from that repository.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:9

Finding

Unpinned Third-Party Skill Installation Creates a Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 9–16
Vulnerability Type: Unpinned third-party dependency installation
Risk Level: Medium

Complete Code Snippet:

markdown

## Install

```bash
npx skills add pskoett/pskoett-ai-skills

bash

npx skills add pskoett/pskoett-ai-skills/skills/intent-framed-agent

text

### Technical Analysis

The documented installation commands retrieve a third-party skill from the mutable `pskoett/pskoett-ai-skills` source without specifying a reviewed version, release, or immutable commit hash. The `npx` package runner is also invoked without a pinned package version.

Consequently, the content installed by these commands can change after this audit without any modification to `SKILL.md`. If the package runner, upstream repository, maintainer account, dependency resolution process, or referenced default branch is compromised, users may receive instructions or executable components different from those reviewed here.

This is a supply-chain weakness rather than evidence that the currently reviewed skill contains a malicious payload. The audited file contains no embedded executable payload, credential access, persistence mechanism, privilege-escalation logic, or destructive command.

### Attack Path

1. An attacker compromises the upstream repository, its maintainer account, the package used by `npx`, or another relevant dependency-distribution component.
2. The attacker modifies the content resolved by one of the unpinned installation commands.
3. A user follows the installation instructions and executes the documented command.
4. The mutable, attacker-controlled version is downloaded and installed instead of the version originally reviewed.
5. When the installed skill or any included executable component is subsequently used, it can issue malicious agent instructions or perform actions under the permissions available to the invoking process.

Exploi
...[truncated 874 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the npx package runner to a reviewed, explicit version rather than relying on mutable package resolution.
2. Pin the skill source to an immutable, reviewed commit hash or cryptographically verified release.
3. Publish expected checksums or signatures and require integrity verification before installation.
4. Prefer a trusted registry, signed release artifact, or vendored copy whose contents can be audited reproducibly.
5. Avoid running installation commands with elevated privileges and perform installation in a sandbox or least-privileged environment.
6. Document the exact reviewed package version, repository revision, and verification procedure so users can reproduce the audited installation.
7. Configure automated dependency and provenance monitoring to detect upstream ownership changes, unexpected revisions, or signature failures.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

The installation command uses npx skills add ... without pinning a specific package version or commit. That means whoever runs the skill may fetch whatever version is current at execution time, creating a supply-chain risk if the upstream package is changed, compromised, or typosquatted.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

This command also installs from a floating upstream path via npx skills add ... with no version pinning. In practice, that allows silent drift in what code or prompts are installed over time, which can enable supply-chain compromise or unexpected behavior if the repository contents change.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.