authoring-data-cli-source

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 11:48 PM UTC
• Version: 1.0.1

Overview

This is a coherent source-authoring guide, but users should be cautious with its unpinned remote install commands and sensitive integration topics.

Before installing, prefer a pinned release or reviewed commit and run setup in a restricted environment without production credentials. When using the skill to build authenticated, browser, scraping, or interact-capable sources, confirm user authorization, keep credentials least-privilege, and require explicit confirmation for remote side effects.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:52
• Finding: Unpinned Remote Installation Sources Create a Mutable Supply-Chain Risk<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:52-67` **Vulnerability Type**: Unpinned third-party packages and mutable remote repository installation **Risk Level**: Medium ### Vulnerable Code ```markdown ## Install From skills.sh Install this skill directly from `skills.sh`: ```bash npx skills add https://github.com/severinzhong/agent-data-cli --skill authoring-data-cli-source ``` ## Install If `agent-data-cli` is not present locally, install it first: ```bash git clone https://github.com/severinzhong/agent-data-cli cd agent-data-cli uv sync ``` ``` ### Technical Analysis The installation procedure invokes `npx skills` without pinning the npm package to a reviewed version. It also clones a remote GitHub repository without selecting an immutable commit hash or verified release tag. The subsequent `uv sync` command resolves and installs dependencies based on the contents of that mutable checkout. This creates a time-of-check/time-of-use supply-chain gap: the software retrieved when a user follows these instructions may differ from the version that existed when the Skill was audited. The downloaded repository, its lock data, build configuration, and dependency behavior are not included in this project and therefore could not be validated as part of this audit. The instructions do not establish that the current remote package or repository is malicious. The vulnerability is the absence of version pinning and integrity verification, which permits a future compromise or unauthorized upstream change to reach users. ### Attack Path 1. An attacker compromises the npm package used by `npx`, the referenced GitHub repository, a maintainer account, or an upstream dependency. 2. The attacker publishes malicious code under the package's default version or changes the repository's default branch. 3. A user follows the documented command using the unpinned `npx skills` invocation or clones the mutable default branch. 4. The user runs `uv sync`, c ...[truncated 1307 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin the `npx` package to a specific reviewed version rather than relying on its current default version. 2. Reference an immutable Git commit hash or a cryptographically verified, signed release instead of cloning the repository's default branch. 3. Publish and verify checksums or signatures for downloaded artifacts before installation. 4. Retain and enforce a reviewed dependency lockfile, including package hashes where supported. 5. Review package lifecycle scripts, build hooks, and transitive dependencies before executing `uv sync`. 6. Run installation in a restricted environment without administrator privileges, production credentials, or unnecessary filesystem access. 7. Separate documentation-only use from installation: users who only need the authoring guidance should not be instructed to download or execute remote code. 8. Document the expected repository revision and dependency versions so that future audits can reproduce the exact installed software. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill explicitly covers scraping, browser automation, authentication, cookies, and remote side effects, but it does not prominently require user consent, credential minimization, privacy review, or warnings about actions against external systems. In this context, the omission is security-relevant because the skill is designed to help implement powerful integrations that can access accounts, collect data, or perform state-changing actions on remote services.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence
• Finding: The skill instructs users to execute `npx skills add` from a remote package path without pinning an exact package version or commit, which creates a supply-chain risk. If the referenced package or its dependency resolution changes, a user may run unexpected code during install, and the skill context makes this more concerning because it targets source authoring workflows involving remote access, scraping, authentication, and browser automation.

Static analysis

No suspicious patterns detected.