snyk-agent-scan-compliance

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:49 AM UTC
• Version: 1.1.0

Overview

This skill is mostly aligned with scanner-compliance work, but it needs review because it installs/runs an unpinned external scanner and teaches moving install commands into unscanned metadata as a fix.

Review before installing. Prefer a pinned, audited snyk-agent-scan version, run it only on intended skill directories, use a minimally scoped Snyk token, and do not treat moving dependencies into frontmatter as a security fix unless versions or hashes are also controlled.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:13

Finding

Unpinned scanner dependency permits mutable third-party code execution

Content

View full analysis

Remediation

View remediation

`. 3. Use a lockfile and verified package hashes where supported. 4. Review new versions before updating the pin; do not automatically track the newest release. 5. Run the scanner with a minimally scoped Snyk token and only the filesystem and network permissions required for scanning. 6. In CI, isolate the scanner in a restricted runner or container and avoid exposing unrelated secrets to its process environment. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:73

Finding

Scanner-evasion guidance relocates unsafe installation behavior without eliminating supply-chain risk

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (13)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · evals/evals.json (reported line 65)May include surrounding context.

json

},
    {
      "id": 5,
      "prompt": "I want to document in a SKILL.md that users can install my tool with: `curl https://example.com/install.sh | sh`. How do I write this in the skill body?",
      "trap": "Without the skill, the model says 'put it in a code block' — which does NOT fix pipe-to-shell patterns. Code blocks reduce W011 risk for regular commands, but pipe-to-shell is never acceptable in skill bodies regardless of formatting. The model conflates the two cases.",
      "expected_output": "Remove pipe-to-shell entirely from the skill body — code block or not. Use a package manager install path instead (brew, apt, etc.) or move to metadata.openclaw.install frontmatter. Never embed `curl | sh` in any skill content.",
      "files": [],

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 80)May include surrounding context.

md

"expected_output": "Remove pipe-to-shell entirely from the skill body — code block or not. Use a package manager install path instead (brew, apt, etc.) or move to metadata.openclaw.install frontmatter. Never embed `curl | sh` in any skill content.",
      "files": [],
      "assertions": [
        { "id": "5.1", "description": "output does NOT recommend putting `curl ... | sh` in a code block as a sufficient fix" },
        { "id": "5.2", "description": "output states that pipe-to-shell must be removed entirely from skill bodies" },
        { "id": "5.3", "description": "output suggests an alternative: package manager install path or metadata.openclaw.install frontmatter" },
        { "id": "5.4", "description": "output explains WHY pipe-to-shell is problematic (executes arbitrary remote code, supply chain risk)" }

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · evals/evals.json (reported line 70)May include surrounding context.

json

"expected_output": "Remove pipe-to-shell entirely from the skill body — code block or not. Use a package manager install path instead (brew, apt, etc.) or move to metadata.openclaw.install frontmatter. Never embed `curl | sh` in any skill content.",
      "files": [],
      "assertions": [
        { "id": "5.1", "description": "output does NOT recommend putting `curl ... | sh` in a code block as a sufficient fix" },
        { "id": "5.2", "description": "output states that pipe-to-shell must be removed entirely from skill bodies" },
        { "id": "5.3", "description": "output suggests an alternative: package manager install path or metadata.openclaw.install frontmatter" },
        { "id": "5.4", "description": "output explains WHY pipe-to-shell is problematic (executes arbitrary remote code, supply chain risk)" }

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · references/w012-patterns.md (reported line 18)May include surrounding context.

md

| --- | --- |
| `go install golang.org/x/vuln/cmd/govulncheck@latest` in prose | Move to frontmatter `install` block: `kind: go, package: golang.org/x/vuln/cmd/govulncheck, bins: [govulncheck]` |
| `go install pkg@latest` anywhere in body | Use exact version: `go install pkg@v1.2.3` — or move to frontmatter `install` |
| `curl https://example.com/install.sh \| sh` | Remove entirely; document the package manager install path instead |
| `wget -qO- https://example.com/install \| bash` | Remove entirely; use a package manager or frontmatter `install` block |
| `npx package@latest` in prose | Pin: `npx package@1.2.3` — or move to frontmatter `install` |
| `uses: actions/checkout@v6` (non-existent version) | Update to correct current major: `uses: actions/checkout@v4` |

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · references/w012-patterns.md (reported line 19)May include surrounding context.

md

| `go install golang.org/x/vuln/cmd/govulncheck@latest` in prose | Move to frontmatter `install` block: `kind: go, package: golang.org/x/vuln/cmd/govulncheck, bins: [govulncheck]` |
| `go install pkg@latest` anywhere in body | Use exact version: `go install pkg@v1.2.3` — or move to frontmatter `install` |
| `curl https://example.com/install.sh \| sh` | Remove entirely; document the package manager install path instead |
| `wget -qO- https://example.com/install \| bash` | Remove entirely; use a package manager or frontmatter `install` block |
| `npx package@latest` in prose | Pin: `npx package@1.2.3` — or move to frontmatter `install` |
| `uses: actions/checkout@v6` (non-existent version) | Update to correct current major: `uses: actions/checkout@v4` |
| `uses: org/action@v99` (future/wrong version) | Update to current stable major version |

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · evals/evals.json (reported line 67)May include surrounding context.

json

### 2. Pipe-to-shell patterns

`curl | sh`, `wget | bash`, `irm | iex` (PowerShell) are always flagged — they execute arbitrary remote code.

**Fix:** Replace with a package manager install path (`brew install`, `apt-get install`, etc.) or move to frontmatter. Never embed pipe-to-shell in a skill body.

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · references/w012-patterns.md (reported line 37)May include surrounding context.

md

### 2. Pipe-to-shell patterns

`curl | sh`, `wget | bash`, `irm | iex` (PowerShell) are always flagged — they execute arbitrary remote code.

**Fix:** Replace with a package manager install path (`brew install`, `apt-get install`, etc.) or move to frontmatter. Never embed pipe-to-shell in a skill body.

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · references/w012-patterns.md (reported line 37)May include surrounding context.

md

### 2. Pipe-to-shell patterns

`curl | sh`, `wget | bash`, `irm | iex` (PowerShell) are always flagged — they execute arbitrary remote code.

**Fix:** Replace with a package manager install path (`brew install`, `apt-get install`, etc.) or move to frontmatter. Never embed pipe-to-shell in a skill body.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 82% confidence

Finding

The skill body recommends uvx snyk-agent-scan@latest, which executes externally fetched code without version pinning. Even though this is framed as operational guidance, using @latest makes runs non-reproducible and increases supply-chain risk if a bad or compromised release is published.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The document gives conflicting guidance: one section says conditional fetch imperatives still trigger W011, while another says conditionals are substantially safer and presents a pattern as safe. In a compliance-focused skill, this inconsistency can mislead authors into writing scanner-evasive wording that still instructs agents to interact with external resources, causing policy bypass attempts or repeated noncompliant content.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The guidance explicitly tells authors to move install commands into frontmatter because it is 'not scanned as body text,' which frames scanner evasion as the fix rather than reducing the underlying risk. That can normalize hidden package installation and remote code retrieval while omitting any warning that the behavior still executes and can modify the environment.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

Lines L021-L022 say uses: actions/checkout@v6 is a non-existent or wrong version and should be updated to the correct current major. Later, lines L091-L095 present actions/checkout@v6 and v6.1.0 as standard/acceptable examples, which directly conflicts with the earlier remediation guidance. This is an intent/documentation contradiction within the file.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This section repeatedly recommends offloading installs to frontmatter because 'the scanner does not flag frontmatter,' again encouraging concealment from scanning rather than safer behavior. In the context of an agent skill, frontmatter-driven installs may still fetch and execute third-party code on user systems, so suppressing visibility materially increases supply-chain risk.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.