Ai Agent Configurator

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 1:20 AM UTC
• Version: 1.0.0

Overview

This skill is a simple React UI integration guide; its main risk is that it asks users to install an unpinned npm package.

Before installing, pin orbcafe-ui to a reviewed version and use your normal dependency review process, especially in CI or environments with sensitive credentials. The skill itself does not show hidden or destructive behavior.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:21

Finding

Unpinned and Unaudited Third-Party npm Dependency

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 21–25
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

bash

## Installation

```bash
npm install orbcafe-ui
# or
pnpm add orbcafe-ui

text

### Technical Analysis

The documented installation commands do not specify an exact version of `orbcafe-ui`. They therefore resolve a registry-selected package version at installation time. The project contains no dependency lockfile, integrity hash, vendored source, or package implementation through which the installed package and its transitive dependencies could be verified.

This creates a supply-chain risk because the reviewed skill text does not uniquely identify the code that users will install. A future compromised, malicious, or unexpectedly changed release could execute npm lifecycle scripts during installation or unsafe code when the imported component is used. The available project evidence does not establish that `orbcafe-ui` is currently malicious; the confirmed issue is the unsafe, non-reproducible dependency installation practice.

### Attack Path

1. An attacker compromises the package publisher account, registry distribution path, or a future package release.
2. The attacker publishes a release containing a malicious lifecycle script or malicious runtime component.
3. A user follows the documented unpinned `npm install orbcafe-ui` or `pnpm add orbcafe-ui` command.
4. The package manager resolves and downloads the attacker-controlled release.
5. Malicious lifecycle code may execute during installation, or malicious runtime code may execute when `CustomizeAgent` is loaded by the application.

### Impact Assessment

Installation-time code could act with the privileges of the user or automation account running the package manager. Depending on that environment, this may permit access to source code, environment variables, developer credentials, CI/CD secrets, and writable p
...[truncated 332 chars]

Remediation

View remediation

Remediation Suggestions

• Pin orbcafe-ui to an exact version that has been reviewed rather than relying on registry-selected resolution.
• Commit and enforce a package-manager lockfile to make dependency resolution reproducible.
• Review the package’s published source, lifecycle scripts, provenance, integrity metadata, and transitive dependency tree before adoption.
• Use reproducible CI installation, such as npm ci, and consider disabling lifecycle scripts with --ignore-scripts when package functionality permits.
• Configure automated dependency scanning and controlled update review.
• Restrict package installation jobs to least-privileged, isolated environments without unnecessary production credentials.
• Prefer registry policies that require package integrity verification and trusted publisher provenance.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.