SchemGuard

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:26 PM UTC
• Version: 0.1.2

Overview

The skill matches its advertised OpenAPI checking purpose, but it tells agents to run an unpinned npm package, including as an MCP server, so it needs review before installation.

Install only if you trust the external npm package and publisher. Prefer pinning an exact reviewed version, running it through a lockfile or vetted container, and isolating CI/MCP execution from unnecessary repository secrets or broad filesystem access.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:14

Finding

Unpinned Third-Party npm Package Execution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 14–23 and 54
Vulnerability Type: Unpinned external npm dependency executed through npx
Risk Level: Medium

Vulnerable Code

bash

# Diff two specs (breaking vs non-breaking)
npx @sethclawd/schemaguard diff old.yaml new.yaml

# CI check (exit 0=safe, 1=breaking, 2=error)
npx @sethclawd/schemaguard ci --spec ./openapi.yaml --baseline ./baseline.yaml

# Lint spec quality
npx @sethclawd/schemaguard lint ./openapi.yaml

# JSON output for programmatic use
npx @sethclawd/schemaguard diff old.yaml new.yaml --format json

bash

npx @sethclawd/schemaguard --mcp

Technical Analysis

The Skill directs users and agents to execute @sethclawd/schemaguard without specifying an exact package version. If the package is not already installed, npx may retrieve it from the configured npm registry and execute its lifecycle or runtime code.

The project contains no package manifest, lockfile, integrity hash, vendored implementation, source revision, or other mechanism that binds execution to the version reviewed during the audit. The effective executable payload can therefore change after the Skill has been reviewed. Package-owner compromise, registry compromise, or a subsequently malicious release could introduce arbitrary code into this execution path.

The package implementation was not included in the audited project, so its actual runtime behavior could not be statically verified. This finding identifies an unsafe supply-chain boundary; it does not assert that the current external package is malicious.

Attack Path

1. An attacker compromises the npm publisher account, release process, or another part of the package supply chain.
2. The attacker publishes a malicious version under the same package name.
3. A user or agent follows SKILL.md and runs one of the unversioned npx @sethclawd/schemaguard ... commands.
4. npx resolves and downloads the attacker-controlled release fro ...[truncated 1027 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the dependency to an audited exact version rather than allowing dynamic resolution, for example:

   bash

   npx --yes @sethclawd/schemaguard@1.2.3 diff old.yaml new.yaml
   

2. Add a package manifest and lockfile containing npm integrity metadata, install dependencies through a controlled process, and invoke the local binary with:

   bash

   npx --no-install schemaguard diff old.yaml new.yaml
   

3. Verify the selected release against its authoritative source repository, publisher identity, provenance attestations, and expected integrity digest before approving it.

4. Configure CI to use a trusted registry, enforce lockfile integrity, disable unexpected lifecycle scripts where compatible, and prevent automatic dependency updates without review.

5. Run the package with least privilege in an isolated environment. Limit filesystem access, network access, environment variables, and credentials to those required for schema analysis.

6. Apply the same pinning and isolation controls to MCP server mode. Review the package implementation and exposed MCP tools before allowing an agent to invoke them.

7. Prefer vendoring or otherwise including reviewable implementation code when practical, especially when the Skill is intended for automated execution in sensitive environments.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

The skill instructs users to execute an npm package via npx without pinning an exact version, which causes retrieval and execution of whatever version is current at runtime. This creates a supply-chain risk: a compromised maintainer account, malicious new release, or dependency takeover could result in arbitrary code execution on the user or agent host.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

This invocation uses npx to fetch and run an unpinned package version during CI checks, allowing execution of newly published code without review. In CI contexts this can be especially dangerous because the process may have access to repository contents, tokens, and deployment credentials.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The lint example also relies on npx with no pinned version, so the code executed can change over time or be replaced by a malicious release. While linting is typically lower privilege than deployment steps, it still executes arbitrary package code on the local or agent machine.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

Providing a JSON-output example with an unpinned npx invocation still encourages remote code execution from a mutable package reference. Any consumer automating around this command may unknowingly trust attacker-controlled output or execute compromised code.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 99% confidence

Finding

The MCP server startup command is especially sensitive because it launches a tool integration endpoint and may be invoked by automated agents with broad filesystem or repo access. Using npx without a pinned version means an attacker controlling the published package or dependency chain could gain arbitrary code execution in a high-trust agent context.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The description says to use the skill when reviewing API changes, validating PRs, checking backward compatibility, or linting spec quality, which are broad scenarios rather than specific invocation triggers. It does not define clear constraints or exclusion conditions, so the skill could be invoked in a wide range of ordinary review contexts beyond the intended narrow use.

Content

No source excerpt is available for this finding.