Defuddle Obsidian

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 5:06 AM UTC
• Version: 1.0.0

Overview

This is a straightforward webpage-to-markdown helper, with the main caution that it asks users to install an unpinned third-party CLI globally.

Install only if you are comfortable using the Defuddle npm package to fetch and convert web pages. Prefer a reviewed, pinned, project-local install when possible, and do not run the npm install command with elevated privileges.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:10

Finding

Unpinned Global Installation of a Third-Party npm Package

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 10–12
Vulnerability Type: Unpinned third-party dependency installed globally
Risk Level: Medium

Vulnerable code snippet:

markdown

If not installed: `npm install -g defuddle`

Technical Analysis

The Skill instructs users or agents to install the latest available version of defuddle from the configured npm registry. The command does not pin a reviewed version or verify package integrity. Consequently, the package contents executed during installation can differ from those assessed when the Skill was reviewed.

npm installation may execute package lifecycle scripts such as preinstall, install, or postinstall. If the package, one of its dependencies, the registry account, or registry resolution is compromised, those scripts can execute arbitrary commands with the privileges of the user running npm.

The -g option also installs the package globally. This exceeds the minimum scope needed to process web pages because a project-local, version-pinned installation would be sufficient. Global installation can modify user-level global npm directories and expose executables across unrelated projects. The instruction does not explicitly request elevated privileges, so root-level impact depends on whether the operator independently runs it with administrative permissions.

The separate instructions to run defuddle parse <url> necessarily cause network access to retrieve a user-selected webpage. That behavior is consistent with the declared webpage-extraction functionality, and the reviewed file does not instruct Defuddle to collect credentials or upload local sensitive files. Therefore, the pre-scan network alert is not confirmed as data exfiltration.

Attack Path

1. An attacker compromises the defuddle npm publisher account, a transitive dependency, or the registry used by the environment.
2. The attacker publishes or serves a maliciou ...[truncated 1198 chars]

Remediation

View remediation

Remediation Suggestions

• Pin Defuddle to a specifically reviewed version instead of resolving the mutable latest release.
• Prefer a project-local dependency recorded in package.json and a committed lockfile rather than using -g.
• Use deterministic installation, such as npm ci, with lockfile integrity metadata.
• Review the selected package version, its transitive dependencies, and any lifecycle scripts before permitting installation.
• Where lifecycle scripts are unnecessary, consider installing with --ignore-scripts, subject to compatibility testing.
• Configure npm to use an approved registry and validate package provenance or signatures where supported.
• Run the parser under a non-privileged account or sandbox with access limited to the required destination URL and output location.
• Document that operators must not use sudo or another privilege-elevation mechanism for installation.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The description says to use this skill whenever the user provides a URL to read or analyze, including broad categories like articles, blog posts, or any standard web page. That scope is ambiguous and lacks constraints or negative examples, which could cause unintended invocation for routine browsing-related requests.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.