Deal-sourcing Scout for VCs

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:19 AM UTC
• Version: 1.0.0

Overview

The skill’s VC scouting purpose is coherent, but it relies on an unpinned globally installed CLI that later handles wallet setup and paid API calls.

Install only if you trust the SELAT CLI publisher and are comfortable with a global npm executable managing wallet setup and paid API calls. Run the dry-run first, review quoted prices, keep wallet funding minimal, and prefer a pinned or isolated install if available.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:12

Finding

Unpinned Global Installation of a Third-Party Executable Dependency

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 12-15 and 63
Vulnerability Type: Unpinned third-party executable dependency
Risk Level: Medium

Vulnerable Code

Dependency declaration at lines 12-15:

yaml

install:
  - kind: node
    package: "@selat-ai/selat-cli"
    bins:
      - selat

Installation command at line 63:

bash

selat --version || npm install -g @selat-ai/selat-cli

Technical Analysis

The skill instructs users to install @selat-ai/selat-cli globally without specifying an exact package version or integrity digest. Consequently, npm resolves a mutable registry release rather than a dependency whose reviewed contents are cryptographically fixed.

The installed component is executable and is later trusted to download skill content, communicate with remote infrastructure, initialize wallet configuration, and perform paid network operations. Global installation also exposes the package's installation lifecycle and executable code to the privileges of the account running npm.

This finding does not establish that the current package is malicious. The vulnerability is the absence of controls ensuring that the package executed by a user is the same version that was reviewed.

Attack Path

1. An attacker compromises the npm package, a maintainer account, or the package publication pipeline.
2. The attacker publishes a malicious or backdoored release under the legitimate package name.
3. A user follows Step 0 while no selat binary is available.
4. npm install -g @selat-ai/selat-cli resolves and installs the attacker-controlled release because no exact version or integrity value is specified.
5. Malicious package lifecycle code or the installed CLI executes with the privileges of the user running npm.
6. The compromised CLI can tamper with downloaded skill definitions or observe later configuration, wallet initialization, and paid-operation workflows.

Impact Assessment

Successful exploitation could ...[truncated 651 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the dependency to a reviewed, exact version rather than relying on the mutable latest release:

   yaml

   package: "@selat-ai/selat-cli@<audited-exact-version>"
   

   bash

   npm install -g @selat-ai/selat-cli@<audited-exact-version>
   

2. Publish and verify the expected npm integrity digest or a signed release artifact before installation.

3. Document the approved package registry explicitly and enforce registry scoping to reduce dependency-confusion risk.

4. Avoid global installation where practical. Run the pinned package in a minimally privileged, isolated environment with restricted filesystem and network access.

5. Disable npm lifecycle scripts during installation when compatible with the package:

   bash

   npm install -g --ignore-scripts @selat-ai/selat-cli@<audited-exact-version>
   

6. Verify package provenance, maintainer identity, and release signatures as part of every dependency update.

7. Pin and independently verify remotely installed skill manifests and endpoint definitions before permitting wallet initialization or paid execution.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.