T08 · Insecure Dependencies
Warning
- Location
README.md:59- Finding
Unpinned npm Package Execution in Installation Commands
- Content
View full analysis
- Remediation
View remediation
Security audit
Ai Readiness
Security checks for vulnerabilities and agentic risk
Overview
The skill’s core file-generation workflow is coherent, but its broad activation wording and unpinned installer/MCP commands create review-worthy control and supply-chain risk.
Install only if you are comfortable with a skill that performs web research, creates many files in your workspace, and can persist in agent instruction/config locations. Prefer manual installation from the reviewed files or pin and inspect npm packages before running the documented npx commands; avoid sending sensitive site data through the hosted MCP unless you trust that service.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T08 · Insecure Dependencies
Warning
- Location
README.md:166- Finding
Unpinned mcp-remote Package Execution with Automatic Confirmation
- Content
View full analysis
- Remediation
View remediation
", "https://ai.silverbackmarketing.com/api/mcp"] ``` 2. Prefer a locally installed dependency recorded in a lockfile with integrity metadata rather than resolving a package dynamically whenever the MCP client starts. 3. Remove `-y` where practical so unexpected installation or resolution behavior is visible to the user. 4. Document how users can inspect and verify the package before enabling the configuration. 5. Use signed releases, npm provenance, publisher multi-factor authentication, and restricted release automation. 6. Run the MCP bridge in a sandbox with minimal filesystem, environment-variable, credential, and network access. 7. Clearly identify the hosted MCP endpoint as an external trust boundary and advise users not to send secrets or sensitive site data unless the service's security and privacy controls have been independently reviewed. ]]>
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (15)
Agent Config Directory Access
High
- Category
- Agent Snooping
- Confidence
- 90% confidence
- Finding
Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.
- Content
Fully quit and reopen Claude Desktop after saving.
OpenAI Codex — add to
~/.codex/config.toml:toml [mcp_servers.ai-readiness]
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description promises a comprehensive website-oriented AI-readiness generator, but the actual code only reads a local JSON file containing a list and writes each record as a line in a JSONL output file. This is a narrow file-conversion utility, not a system that analyzes a website or generates multiple AI-readiness artifacts. The behavior is materially different from the declared primary purpose, so this is a clear mismatch.
- Content
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The invocation scope is extremely broad, triggering on many vague phrases related to AI crawlers, visibility, and indexing. This increases the chance of accidental activation, causing unsolicited web research and mass file creation for requests that did not clearly authorize such behavior.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md **📖 Live site & full docs:** **[ai.silverbackmarketing.com](https://ai.silverbackmarketing.com)** · ⭐ Star this repo if it helps you get found by AI. <p align="center"> <a href="https://www.producthunt.com/products/ai-readiness-kit?embed=true&utm_source=badge-featured&utm_medium=badge&utm_campaign=badge-ai-readiness-kit" target="_blank"><img src="https://api.producthunt.com/widgets/embed-image/v1/featured.svg?post_id=1178266&theme=light" alt="AI Readiness Kit - The 17 files that make your site understandable to AI | Product Hunt" width="250" height="54"></a> </p> ---
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md - **Claude Cowork one-click:** download and open [`ai-readiness.skill`](ai-readiness.skill). - **Any AI, manually:** copy [`SKILL.md`](SKILL.md) into the assistant's system prompt or custom instructions. After installing, trigger it with `/ai-readiness yoursite.com` in Claude, or just ask any agent: *"create AI readiness files for yoursite.com."* ### Use via MCP (no install)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill encourages activation from broad natural-language requests such as 'create AI readiness files for yoursite.com,' which can overlap with ordinary discussion and cause the agent to invoke the skill unexpectedly. In an agent environment, ambiguous triggers increase the chance of unintended actions like research, file generation, or external service usage without clear user intent.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
These example prompts define activation conditions loosely enough that an agent may invoke the skill whenever related topics are mentioned, not only when the user requests execution. That can lead to prompt/skill overreach, where normal advice-seeking about AI crawlers or visibility triggers workflow execution and possible network or file operations.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Quick test:
bash curl -X POST 'https://ai.silverbackmarketing.com/api/mcp' \ -H 'Content-Type: application/json' \ -H 'Accept: application/json, text/event-stream' \ -d '{"jsonrpc":"2.0","method":"tools/list","params":{},"id":1}'
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The usage section repeats broad, generic trigger phrases that can be interpreted as activation rules by host agents. In systems that auto-load or prioritize skills, overly permissive triggers can cause the skill to run in contexts the user did not intend, expanding attack surface through unnecessary file writes and external lookups.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 82% confidence
- Finding
The skill directs the agent to read references and write a large set of output files, but it does not explicitly declare a restrictive tool scope or permissions. That creates an authorization and transparency gap: an agent may be induced to perform file operations broader than a user reasonably expects, especially when the trigger conditions are very broad.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill does not prominently warn that it will perform extensive workspace writes, including a folder and 18 files. In agent environments, weak disclosure around bulk file creation can lead to surprising side effects, overwrite risk, and reduced user control over local artifacts.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill instructs the agent to execute inline Python to transform generated JSON into JSONL. Even though the snippet is simple, introducing code execution where plain file transformation could be handled natively expands the attack surface and normalizes shell/Python execution inside a content-generation skill.
- Content
Static analysis
No suspicious patterns detected.