sn-update

• Outcome: Review
• Latest audit: Sep 16, 2026 · 11:08 AM UTC
• Version: 2026.8.19

Overview

This skill is an updater that intentionally changes installed agent skills, but it allows unverified repository content, including forks, to be copied into active skill directories.

Review the source repository before using this skill, especially if any fork URL is supplied. Use it only when you intend to let it replace installed sn-* skills, and keep separate backups if you need more than the newest three rollback points.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:60

Finding

Untrusted Fork Content Can Be Installed into the Active Agent Skill Directory

Content

View full analysis

` paths before copying them. `--filter=blob:none` alone does **not** keep the cache small if the full worktree is checked out; that checkout will still download most or all needed blobs. It still preserves history metadata for SHA queries. - **Subsequent runs**: fetch + hard-reset to the upstream default branch, and re-apply sparse-checkout for only the requested `skills/` paths before copying. If updating the whole `sn-*` bundle, expect most/all skill blobs to be downloaded. - **URL changed**: if cache's `origin` differs from the requested URL, delete and re-clone. ``` ```text 1. **Move** (not copy) any existing `//` into a single timestamped backup bucket shared by all skills in this run: `~/./skills_backup///` (e.g. `2026-04-30T15-29-07Z`). 2. **Copy** `/skills//` → `//`. **Never symlink** (`ln -s`) from the cache. The cache lives under `~/.cache/` with permissions the agent runtime may not be able to traverse, and some runtimes refuse to load skills resolved through symlinks. Always do a real recursive copy so the installed tree is self-contained and owned by the agent skills dir. 3. **Write `.sn-version`** with the upstream subtree SHA inside the new copy. ``` ### Technical Analysis The update procedure explicitly permits the user to replace the default repository with a fork URL. It ...[truncated 2446 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Tp2

High

• Category: MCP Tool Poisoning
• Confidence: 85% confidence

Finding

Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Content

No source excerpt is available for this finding.

Tp2

High

• Category: MCP Tool Poisoning
• Confidence: 85% confidence

Finding

Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Content

No source excerpt is available for this finding.

Tp2

High

• Category: MCP Tool Poisoning
• Confidence: 85% confidence

Finding

Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Content

No source excerpt is available for this finding.

Tp2

High

• Category: MCP Tool Poisoning
• Confidence: 85% confidence

Finding

Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Content

No source excerpt is available for this finding.

Tp2

High

• Category: MCP Tool Poisoning
• Confidence: 85% confidence

Finding

Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Content

No source excerpt is available for this finding.

Tp2

High

• Category: MCP Tool Poisoning
• Confidence: 85% confidence

Finding

Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 100)May include surrounding context.

md

field. If either side lacks it, C does not apply.
- **Nothing usable** → treat as stale and install.

Always write `.sn-version` on install so future runs can use A.

---

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The skill instructs automatic deletion of older backup buckets after each run, but the description shown to users does not prominently warn that historical backups beyond the newest three will be removed. In a skill that modifies installed agent components, this can cause irreversible loss of rollback points and operational data if the user expected backups to accumulate safely.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.