Security audit

authoring-data-cli-source

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent source-authoring guide, but users should be cautious with its unpinned remote install commands and sensitive integration topics.

Before installing, prefer a pinned release or reviewed commit and run setup in a restricted environment without production credentials. When using the skill to build authenticated, browser, scraping, or interact-capable sources, confirm user authorization, keep credentials least-privilege, and require explicit confirmation for remote side effects.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:52
Finding: Unpinned Remote Installation Sources Create a Mutable Supply-Chain Risk
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill explicitly covers scraping, browser automation, authentication, cookies, and remote side effects, but it does not prominently require user consent, credential minimization, privacy review, or warnings about actions against external systems. In this context, the omission is security-relevant because the skill is designed to help implement powerful integrations that can access accounts, collect data, or perform state-changing actions on remote services.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: The skill instructs users to execute npx skills add from a remote package path without pinning an exact package version or commit, which creates a supply-chain risk. If the referenced package or its dependency resolution changes, a user may run unexpected code during install, and the skill context makes this more concerning because it targets source authoring workflows involving remote access, scraping, authentication, and browser automation.
Content: No source excerpt is available for this finding.