Security audit

snyk-agent-scan-compliance

Security checks for vulnerabilities and agentic risk

Overview

The skill is a real scanner-compliance helper, but it repeatedly steers users to move risky install instructions into less-visible frontmatter and treats that as safe, so changes should be reviewed carefully.

Install only if you want a scanner-specific editing assistant and are prepared to review every change it makes to skill metadata, install blocks, allowed tools, and dependency versions. Do not treat moving a command into frontmatter as a security fix by itself; verify package provenance, pin versions where possible, and keep SNYK_TOKEN handling limited to trusted local or CI contexts.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Intent-Code Divergence

Medium

Confidence: 96% confidence
Finding: The document first states that conditional fetch imperatives like 'If X, check/fetch Y' trigger W011, but later says conditional phrasing is 'substantially safer' and presents examples that normalize conditional external-action instructions. This inconsistency can mislead skill authors into preserving or introducing agent-directed retrieval behavior that the scanner is meant to prevent, weakening compliance guidance and potentially enabling externally influenced agent actions.

Intent-Code Divergence

Medium

Confidence: 97% confidence
Finding: The document gives contradictory guidance by first calling `actions/checkout@v6` a wrong or non-existent major version, then later presenting `@v6` as a standard safe example. In a compliance/reference skill, this can mislead users into pinning to invalid or unintended action versions, weakening supply-chain hygiene and causing broken or unsafe workflow configurations.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The text explicitly recommends moving install commands into frontmatter because it is 'not scanned as body text,' which teaches scanner evasion rather than safer behavior. Although the commands may be less visible to the scanner, they still fetch and may execute external code at runtime, preserving the underlying supply-chain risk while reducing detection.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: Saying 'the scanner does not flag frontmatter' encourages users to relocate risky behavior into an unscanned area instead of reducing risk. In this skill's context, that is especially dangerous because the file is framed as compliance guidance for passing a scanner, so users are likely to follow it as an approved bypass.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The instruction to move install commands into frontmatter to avoid findings omits the fact that package installation still changes the user's environment and may introduce malicious or compromised dependencies. This effectively normalizes bypassing security controls in a document intended to help users satisfy a scanner.

Static analysis

No suspicious patterns detected.