Automated Response Rule

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 1:23 AM UTC
• Version: 1.0.0

Overview

This skill is a straightforward React UI integration guide, but users should pin and review the external npm package before installing it.

Before installing, pin `orbcafe-ui` to a reviewed exact version, use a lockfile, and install/build in a least-privileged environment. Treat this as normal third-party package risk rather than evidence that the skill itself is malicious.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:20

Finding

Unpinned Third-Party npm Dependency Creates Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 20–22
Vulnerability Type: Unpinned third-party dependency installation
Risk Level: Medium

bash

npm install orbcafe-ui
# or
pnpm add orbcafe-ui

Technical Analysis

The installation instructions reference orbcafe-ui without specifying an exact reviewed version, lockfile, integrity hash, or trusted source revision. Consequently, the package contents installed by these commands can change after the skill has been reviewed.

npm-compatible package managers may also execute package lifecycle scripts during installation. If the package registry account, publication process, or dependency chain is compromised, a malicious release could execute code under the privileges of the user or CI service performing the installation. The external package source was not included in the audited project, so its implementation and installation behavior could not be verified.

This finding does not establish that orbcafe-ui is currently malicious. It identifies an unsafe and mutable dependency-installation pattern.

Attack Path

1. An attacker compromises the package publisher, registry account, publication pipeline, or a transitive dependency.
2. The attacker publishes a malicious version under the referenced package name.
3. A developer or automated build follows the documented command without an exact version or reviewed lockfile.
4. The package manager resolves and downloads the attacker-controlled release.
5. Malicious lifecycle scripts may execute during installation, or malicious runtime code may execute when CustomizeAgent is imported and rendered.
6. The payload operates with the permissions and environmental access of the developer account or CI worker.

Impact Assessment

Successful exploitation could permit arbitrary code execution with the privileges of the package-installation process. Depending on the installation environment, the affected scope may include source code, acc ...[truncated 487 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the dependency to an exact version that has undergone security and provenance review, rather than relying on the registry’s current default release.
2. Commit and enforce a package-manager lockfile so installations resolve to reviewed package versions and integrity values.
3. Verify the package publisher, repository, release provenance, signatures or attestations, and registry integrity metadata before adoption.
4. Audit the package and its transitive dependencies, including all lifecycle scripts and code executed when CustomizeAgent is imported or rendered.
5. Use npm install --ignore-scripts or the corresponding pnpm setting when lifecycle scripts are not required. If scripts are necessary, explicitly review and allow only the required behavior.
6. Run dependency installation and builds in an isolated, least-privileged environment without unnecessary credentials or host filesystem access.
7. Add automated dependency scanning and controlled update review so future version changes are tested and approved before deployment.
8. Document the approved package version and trusted source in SKILL.md rather than directing users to install a mutable release implicitly.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep