decision-clarity-skill

• Outcome: Pass
• Latest audit: Sep 15, 2026 · 1:07 AM UTC
• Version: 1.0.0

Overview

This is a plain reasoning skill for clearer decisions, with no artifact-backed evidence of hidden data access, persistence, destructive behavior, or command execution beyond standard install instructions.

Install only from a source and commit you trust, and consider pinning the installer version or reviewing the package before use. Expect the skill to reframe vague decision questions and challenge assumptions; do not use it where you want a simple factual answer without analysis.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: README.md:97

Finding

Unpinned Third-Party CLI Execution in Installation Instructions

Content

View full analysis

Vulnerability Details

File Location: README.md, lines 97–103
Vulnerability Type: Unpinned npm CLI and mutable repository dependency
Risk Level: Medium

Complete Code Snippet:

bash

npx skills add shanezzzz/decision-clarity-skill

You can also inspect the package before installing:

bash

npx skills add shanezzzz/decision-clarity-skill --list

Technical Analysis

The documented installation commands invoke the skills npm package through npx without specifying an exact package version or integrity value. Depending on the local npm configuration and cache state, npx can retrieve and execute the currently resolved package version from the configured npm registry.

The referenced GitHub skill, shanezzzz/decision-clarity-skill, is also not pinned to a reviewed commit hash. Both the installer and installed content can therefore change after this project has been audited. The --list variant reduces the intended operation but still invokes the same unpinned third-party CLI.

This creates a supply-chain trust boundary in which mutable external components receive local execution capability. The repository itself contains no malicious scripts, but the documented installation process cannot guarantee that future resolved CLI or skill content will match the audited versions.

Attack Path

1. An attacker compromises the npm account, registry package, publishing process, or another source used to resolve the skills CLI.
2. Alternatively, an attacker compromises or maliciously updates the referenced GitHub repository.
3. A user follows either documented npx skills command.
4. npx resolves and potentially downloads the mutable third-party CLI package.
5. The retrieved package executes with the privileges and environment of the invoking user.
6. A compromised CLI could execute arbitrary local commands, access files available to that user, read inherited environment variables, or i ...[truncated 876 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the CLI to an exact, reviewed version rather than relying on the latest registry resolution:

   bash

   npx --yes skills@<reviewed-exact-version> add shanezzzz/decision-clarity-skill
   

2. Pin the referenced skill repository to a trusted commit hash or immutable release tag if the CLI supports immutable references.
3. Publish and verify cryptographic checksums or signatures for both the installer and skill package.
4. Add a lockfile or equivalent dependency manifest where supported and enforce integrity verification during installation.
5. Recommend inspecting the resolved package contents without executing package lifecycle code. The current --list command is not a complete security boundary because it still executes the unpinned CLI.
6. Run installation in a restricted environment without administrative privileges, sensitive environment variables, or access to unrelated credentials.
7. Configure npm to use a trusted registry and apply provenance or signature verification where available.
8. Document the exact CLI version and skill commit that were reviewed so users can reproduce the audited installation.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger phrases are broad, natural-language prompts like 'Help me think this through' and 'What am I missing?', which overlap heavily with common user requests. In systems that auto-route or auto-invoke skills based on prompt similarity, this can cause unintended activation, leading to inappropriate context capture, workflow interference, or unexpected reasoning behavior where the user did not explicitly request this skill.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill description contains very broad trigger phrases like 'help me think this through' and 'what am I missing?' that are common in ordinary conversation and could cause the agent to invoke this skill in many unrelated contexts. Over-broad routing can override more appropriate domain-specific skills, leading to misclassification of user intent and unnecessary exposure of user queries to a generic reasoning workflow.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/anti-patterns.md (reported line 31)May include surrounding context.

md

### 2. Solving the wrong question well

Bad pattern:
Accepting the user's framing without checking whether it is the real issue.

Correction:
Clarify the actual goal before analyzing solutions.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The example "What am I missing?" is a very common, context-agnostic phrase that could be encountered in many ordinary conversations. In a trigger-reference file, listing such a broad phrase without scope limits or exclusion conditions creates ambiguity about when the skill should activate versus when it should not.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 72% confidence

Finding

The phrase "Which option makes the most sense?" is generic and widely used across routine conversations. Because the file does not define scope boundaries or exclusions, it is unclear when this question should invoke the sharper-analysis behavior rather than be treated as ordinary dialogue.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.