companies-house-cli

• Outcome: Pass
• Latest audit: Sep 14, 2026 · 11:33 PM UTC
• Version: 0.3.1

Overview

This is a coherent Companies House lookup skill, with the main caveat that it asks users to install a third-party npm CLI and provide an API key.

Before installing, treat the npm package as trusted third-party code: consider pinning a reviewed version, avoid exporting the API key more broadly than needed, keep any `.env` file out of version control, and rotate the key if you suspect the package or environment was compromised.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:11

Finding

Unpinned Global npm Dependency Handles an API Credential

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 11–21, 30–34, and 104–108
Vulnerability Type: Unpinned third-party dependency and supply-chain exposure
Risk Level: Medium

Vulnerable Code

yaml

"primaryEnv": "COMPANIES_HOUSE_API_KEY",
"install":
  [
    {
      "id": "npm",
      "kind": "node",
      "package": "@shan8851/companies-house-cli",
      "bins": ["ch"],
      "label": "Install companies-house-cli (npm)",
    },
  ],

markdown

Setup

- `npm install -g @shan8851/companies-house-cli`
- Get a free API key: https://developer.company-information.service.gov.uk/
- `export COMPANIES_HOUSE_API_KEY=your_key` or add it to a local `.env`

markdown

- API key required (free, instant signup at Companies House developer portal)
- Auth is HTTP Basic (key as username, blank password)
- Rate limit: 600 requests per 5 minutes
- Company numbers are automatically zero-padded to 8 digits

Technical Analysis

The Skill instructs users to globally install @shan8851/companies-house-cli without pinning a version or providing an integrity hash. The installed executable subsequently receives access to COMPANIES_HOUSE_API_KEY, which is used as an HTTP Basic authentication username.

Network access and transmission of the API key to the official Companies House service are necessary for the declared company-record lookup functionality. However, the project contains only SKILL.md; the dependency implementation is not present for review. Consequently, the audit cannot verify its lifecycle scripts, effective network destinations, telemetry, local file access, or credential handling.

An unpinned installation may retrieve a different package release each time. If the npm package, publisher account, or release pipeline is compromised, malicious code could run during npm installation or when the ch executable is invoked. Global installation increases the exposure ...[truncated 2042 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the package to a specific, reviewed version rather than installing the latest available release:

   sh

   npm install --global @shan8851/companies-house-cli@<reviewed-version>
   

2. Publish or link to the dependency's auditable source code and verify that the npm artifact corresponds to that source.
3. Provide npm provenance, a lockfile where applicable, and documented integrity hashes for approved releases.
4. Prefer a project-local, locked installation over a global installation to reduce command-path and system-wide exposure.
5. Audit all npm lifecycle scripts and transitive dependencies. Where operationally compatible, install with lifecycle scripts disabled.
6. Explicitly document the official Companies House API hostname and enforce an allowlist so the API key cannot be sent to arbitrary destinations.
7. Ensure authentication is performed exclusively over HTTPS with certificate validation enabled.
8. Inject the credential only into the ch process rather than exporting it broadly to a long-lived shell environment.
9. If .env storage remains supported, require restrictive file permissions and ensure .env is excluded from version control.
10. Document key rotation and revocation procedures so users can promptly invalidate a credential after suspected dependency compromise.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.