Edith Augment Code

• Outcome: Review
• Latest audit: Sep 16, 2026 · 3:40 AM UTC
• Version: 1.0.0

Overview

The skill is a transparent Auggie CLI wrapper, but it may route broad coding requests and project context to a third-party CLI without narrow confirmation.

Install only if you intentionally want ordinary coding, debugging, and codebase-analysis requests handled through Auggie. Prefer pinning and reviewing the CLI version, avoid installing it with elevated privileges, and confirm the repository or file scope before using it on private or sensitive code.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:14

Finding

Unpinned Global Installation of a Third-Party CLI

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 14
Vulnerability Type: Unpinned third-party dependency installed globally
Risk Level: Medium

Vulnerable Code Snippet:

markdown

- Auggie CLI installed: `npm install -g @augmentcode/auggie`

Technical Analysis

The documented prerequisite installs @augmentcode/auggie globally without specifying a reviewed version or verifying package integrity. Consequently, npm resolves the package through its mutable distribution tag, normally latest. The downloaded package may also execute npm lifecycle scripts during installation.

Because the dependency implementation and a corresponding lockfile are not included in this project, its behavior cannot be validated as part of this audit. A compromised package publisher, registry account, distribution tag, or newly released package version could introduce malicious installation scripts or executable code after this skill has already been reviewed.

Global installation increases exposure because the resulting executable is placed in the user's global npm binary path and may subsequently be invoked by this skill or from unrelated projects.

Attack Path

1. An attacker compromises the npm package publisher, publishing workflow, registry account, or another component of the package's supply chain.
2. The attacker publishes a malicious version of @augmentcode/auggie and assigns it to the version tag resolved by the unpinned installation command.
3. A user follows the documented prerequisite and runs npm install -g @augmentcode/auggie.
4. npm downloads the attacker-controlled release without enforcing a previously reviewed version or integrity value.
5. Malicious npm lifecycle scripts may execute during installation, or malicious CLI logic may execute when the documented auggie commands are later invoked.
6. The payload operates with the permissions of the user who performed the installation or invoked ...[truncated 694 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the dependency to an explicitly reviewed version, for example @augmentcode/auggie@X.Y.Z, rather than relying on a mutable distribution tag.
2. Prefer a project-local dependency managed through package.json and a committed lockfile instead of a global installation.
3. Install with a lockfile-enforcing workflow such as npm ci so dependency resolution fails when recorded versions or integrity hashes differ.
4. Verify the package's official provenance, publisher identity, signatures or attestations, and npm integrity metadata before approving upgrades.
5. Review direct and transitive dependency changes before updating the pinned version.
6. Disable lifecycle scripts during installation with --ignore-scripts when the package does not require them. If scripts are required, review them before execution.
7. Run the CLI under a least-privileged account or isolated environment with access limited to the repository and files required for the task.
8. Avoid installing the package with administrative privileges and document the expected permissions and external services used by the CLI.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill is marked user-invocable and its description triggers on very broad requests like building, coding, debugging, analyzing, or prototyping. This can cause the skill to activate for a large share of ordinary developer conversations, increasing the chance that code and repository context are sent to the external auggie CLI without a narrowly scoped user intent or explicit confirmation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The activation guidance lists common requests such as 'build me', 'analyze this codebase', and 'fix the auth bug' without boundaries, making accidental invocation likely. In this skill's context, invocation can lead to external tool usage over the current project, which may expose sensitive code, secrets, or internal architecture to a third-party service beyond what the user specifically intended.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.