Skill

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:43 AM UTC
• Version: 1.0.1

Overview

The skill is a small dashboard installer, but it asks users to globally install and run an unpinned third-party npm package whose implementation is not included for review.

Install only if you trust the npm package publisher and are comfortable running its code with your user account permissions. Prefer a pinned reviewed version, inspect the package source and lifecycle scripts, and run it in an isolated project or container if it will see sensitive project or agent state.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:13

Finding

Unpinned Global Installation and Execution of a Third-Party npm Package

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 13-17
Vulnerability Type: Unpinned third-party dependency installed globally and immediately executed
Risk Level: Medium

bash

**Via npm:**
```bash
npm install -g @reghoul/pm-dashboard
pm-dashboard init
pm-dashboard start

text

### Technical Analysis

The installation instructions retrieve the currently published version of `@reghoul/pm-dashboard` without specifying an exact version or verifying its integrity or provenance. The package is installed globally and its commands are then immediately executed.

npm packages can run installation lifecycle scripts, while the subsequent `init` and `start` commands execute package-controlled code directly. Because the package implementation is not included in the audited project, its filesystem operations, network communications, server configuration, and treatment of project-state data cannot be independently reviewed from this artifact.

The same supply-chain exposure also applies to the unpinned update command documented at `SKILL.md`, lines 44-48:

```bash
**Via npm:**
```bash
npm update -g @reghoul/pm-dashboard

text

This finding does not establish that the referenced package is malicious. It identifies an unsafe dependency acquisition and execution pattern that permits an unreviewed or compromised future release to become the effective executable payload.

### Attack Path

1. An attacker compromises the package publisher account, registry release process, or another relevant supply-chain component.
2. The attacker publishes a malicious release under the expected package name.
3. A user follows the documented command without an exact version constraint.
4. npm resolves and globally installs the attacker-controlled release.
5. Malicious lifecycle code may execute during installation, or malicious runtime code executes when the user invokes `pm-dashboard init` or `pm-dashboard start`.

...[truncated 841 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the dependency to a specific, reviewed version rather than resolving the latest release:

   bash

   npm install --global @reghoul/pm-dashboard@<reviewed-version>
   

2. Document the expected package provenance, publisher identity, source repository, and release verification process.
3. Verify registry integrity metadata or signed release provenance before installation.
4. Prefer a project-local or isolated installation over a global installation, and execute it through a controlled package script or sandbox.
5. Review npm lifecycle scripts before installation and disable them with --ignore-scripts where compatible with the package.
6. Run the dashboard under a dedicated, least-privileged account or container with narrowly scoped filesystem and network access.
7. Replace unrestricted update instructions with a controlled process that pins, reviews, tests, and approves each new version before deployment.
8. Include the dashboard implementation or a verifiable source reference in the audited artifact so its server exposure, state handling, and network behavior can be assessed.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.