me.txt

• Outcome: Review
• Latest audit: Sep 11, 2026 · 12:23 AM UTC
• Version: 1.0.0

Overview

The skill is mostly coherent, but it recommends unpinned npx commands that can download and run mutable third-party code on the user's machine.

Review before installing if your agent may run shell commands. Prefer the manual me.txt creation and direct HTTPS fetch instructions, or only run the CLI with an exact reviewed version in a restricted environment without unnecessary credentials.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:87

Finding

Unpinned Third-Party Package Download and Execution via npx

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 87–97
Vulnerability Type: Unpinned and unaudited dependency execution
Risk Level: High

Vulnerable code:

markdown

If the user has a GitHub profile, offer to pre-fill from it using: `npx create-me-txt --github username`

## Fetching a me.txt

To look up someone's me.txt, try these URLs in order:

1. `https://domain.com/me.txt`
2. `https://domain.com/.well-known/me.txt`
3. `https://metxt.org/api/lookup?domain=domain.com` (directory fallback)

Or use the CLI: `npx create-me-txt` then run `me-txt fetch domain.com`

Technical Analysis

The Skill recommends executing create-me-txt through npx without specifying an exact package version, integrity value, or verified source. If the package is not already installed locally, npx may retrieve the current package release from the configured npm registry and immediately execute it.

Consequently, the code executed is mutable after the Skill has been reviewed. Compromise of the package, maintainer account, registry publication process, or dependency chain could cause arbitrary third-party code to execute in the user's environment. The package receives at least a GitHub username in the pre-fill workflow and may inherit the process environment and the user's filesystem permissions.

This execution exceeds minimum privilege because the Skill already documents procedures for manually creating and fetching a me.txt file. Running an external package is therefore optional rather than essential to the declared functionality.

The documented directory fallback at https://metxt.org/api/lookup?domain=domain.com performs expected network access for the lookup feature. It discloses the requested domain and requester network metadata to the service, but the reviewed text does not direct transmission of credentials, environment variables, or private local files.

Attack Path

1. An attacker compromises ...[truncated 1155 chars]

Remediation

View remediation

Remediation Suggestions

1. Prefer the documented manual creation, direct HTTPS retrieval, and local structural validation procedures instead of executing an npm package.
2. If the CLI remains necessary, pin it to an exact reviewed version rather than allowing npx to resolve the latest release.
3. Verify package ownership, provenance, release signatures where available, and package integrity before use.
4. Review the package and its transitive dependency tree before approving execution.
5. Install dependencies through a committed lockfile and use integrity-enforcing installation workflows.
6. Disable lifecycle scripts where compatible with the package and avoid implicit installation through npx.
7. Run the CLI in a restricted sandbox or container with no unnecessary credentials, minimal filesystem mounts, and limited outbound network access.
8. Require explicit user confirmation before downloading or executing third-party code and clearly disclose the package source and version.
9. Require confirmation before external lookups and avoid submitting private or internal domain names to the directory fallback.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The skill instructs users to execute npx create-me-txt without pinning an exact package version or verifying package integrity. This creates a supply-chain risk: a malicious or compromised future release could be fetched and executed automatically, and because npx runs code from the package, exploitation could lead to arbitrary code execution on the user's system.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The validation/fetch workflow again recommends running npx create-me-txt without an exact version, exposing users to the same unbounded package-resolution risk. In this skill's context, the command is presented as normal setup/utility usage, which makes users more likely to execute it without scrutiny and increases the chance of supply-chain compromise leading to arbitrary code execution.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.