T08 · Insecure Dependencies
Warning
- Location
README.md:41- Finding
Unpinned npm Package and Mutable Runtime Dependency Create a Supply-Chain Execution Risk
- Content
View full analysis
- Remediation
View remediation
Security audit
Cybernetic Thinking
Security checks for vulnerabilities and agentic risk
Overview
This appears to be a legitimate thinking-skill package with a disclosed installer, but users should pin versions and review which agent directories it will modify.
Install only from a trusted source, prefer a pinned command such as npx skill-cybernetic-thinking@0.6.0 install, avoid --force unless you intend to replace an existing install, and review whether it will install globally, project-locally, or into shared cross-agent skill folders.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (60)
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 85% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md ### Notes - **npm**: the old package `skill-systems-thinking` cannot be renamed on npm; it will be marked as `deprecated` pointing to the new name. Users must install `skill-cybernetic-thinking` instead. - **Repo**: GitHub and Gitee repository renamed from `systems-thinking` to `cybernetic-thinking` (old URLs auto-redirect). - **Existing users**: remove the old skill directory (e.g. `rm -rf ~/.config/kilo/skills/skill-systems-thinking`) and reinstall with the new `npx` command. ---
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md This skill targets AI coding agents that support custom skills (Claude Code, Codex, Kilo, WorkBuddy, Trae, Cursor, Aider, etc.). > **Renamed in 0.4.0**: the package was renamed from `skill-systems-thinking` to `skill-cybernetic-thinking`. If you installed the old name, remove it first: `rm -rf ~/.config/kilo/skills/skill-systems-thinking` (adjust for your agent), then install the new one. ### npx install (recommended)
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md This skill targets AI coding agents that support custom skills (Claude Code, Codex, Kilo, WorkBuddy, Trae, Cursor, Aider, etc.). > **Renamed in 0.4.0**: the package was renamed from `skill-systems-thinking` to `skill-cybernetic-thinking`. If you installed the old name, remove it first: `rm -rf ~/.config/kilo/skills/skill-systems-thinking` (adjust for your agent), then install the new one. ### npx install (recommended)
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 85% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md This skill targets AI coding agents that support custom skills (Claude Code, Codex, Kilo, WorkBuddy, Trae, Cursor, Aider, etc.). > **Renamed in 0.4.0**: the package was renamed from `skill-systems-thinking` to `skill-cybernetic-thinking`. If you installed the old name, remove it first: `rm -rf ~/.config/kilo/skills/skill-systems-thinking` (adjust for your agent), then install the new one. ### npx install (recommended)
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md 本 skill 面向支持自定义 skill 的 AI 编程助手（Claude Code、Codex、Kilo、WorkBuddy、Trae、Cursor、Aider 等）。 > **0.4.0 改名**：包名从 `skill-systems-thinking` 改为 `skill-cybernetic-thinking`。装过旧名的用户请先删掉旧链接：`rm -rf ~/.config/kilo/skills/skill-systems-thinking`（路径按你的 agent 调整），再装新的。 ### npx 安装（推荐）
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md 本 skill 面向支持自定义 skill 的 AI 编程助手（Claude Code、Codex、Kilo、WorkBuddy、Trae、Cursor、Aider 等）。 > **0.4.0 改名**：包名从 `skill-systems-thinking` 改为 `skill-cybernetic-thinking`。装过旧名的用户请先删掉旧链接：`rm -rf ~/.config/kilo/skills/skill-systems-thinking`（路径按你的 agent 调整），再装新的。 ### npx 安装（推荐）
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md 本 skill 面向支持自定义 skill 的 AI 编程助手（Claude Code、Codex、Kilo、WorkBuddy、Trae、Cursor、Aider 等）。 > **0.4.0 改名**：包名从 `skill-systems-thinking` 改为 `skill-cybernetic-thinking`。装过旧名的用户请先删掉旧链接：`rm -rf ~/.config/kilo/skills/skill-systems-thinking`（路径按你的 agent 调整），再装新的。 ### npx 安装（推荐）
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 85% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md 本 skill 面向支持自定义 skill 的 AI 编程助手（Claude Code、Codex、Kilo、WorkBuddy、Trae、Cursor、Aider 等）。 > **0.4.0 改名**：包名从 `skill-systems-thinking` 改为 `skill-cybernetic-thinking`。装过旧名的用户请先删掉旧链接：`rm -rf ~/.config/kilo/skills/skill-systems-thinking`（路径按你的 agent 调整），再装新的。 ### npx 安装（推荐）
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 85% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md 本 skill 面向支持自定义 skill 的 AI 编程助手(Claude Code、Codex、Kilo、WorkBuddy、Trae、Cursor、Aider 等)。 > **0.4.0 改名**:包名从 `skill-systems-thinking` 改为 `skill-cybernetic-thinking`。装过旧名的用户请先删掉旧链接:`rm -rf ~/.config/kilo/skills/skill-systems-thinking`(路径按你的 agent 调整),再装新的。 ### npx 安装(推荐)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The declared description presents the skill as a cognitive/reasoning framework for LLM behavior. The supplied code chunk does not implement reasoning logic, control-theoretic analysis, or any behavior related to shaping model thought. Instead, it is purely an installer utility that scans for supported agent directories and links/copies the skill into them. While an installer can be part of packaging for such a skill, this code chunk’s actual primary function is software installation and filesystem manipulation, which is materially different from the declared purpose. Therefore the description does not accurately represent what this code chunk actually does.
- Content
Anti-Refusal Statement
High
- Category
- Anti-Refusal
- Confidence
- 91% confidence
- Finding
The phrase 'Do not refuse to act because the model is incomplete' weakens a safety boundary by biasing the agent away from abstaining when uncertainty is high. In an agent skill that shapes reasoning behavior broadly, this can encourage action under insufficient evidence and reduce the chance the model pauses for clarification, risk checks, or safe escalation.
- Content
md - Do not refuse to act because the model is incomplete. Use feedback to *build* the model
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 85% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md - New excerpts from Book 2 in `references/original-text.md` (§1.1, §1.6, §1.7–§1.8, §2.4, §3.3, §3.7, §4.2, §5.1, §5.4, §5.6) - `--path <dir>` flag to install into a custom directory (for agents not on the built-in list) - Interactive install menu: scan results are listed with `[√]`/`[ ]` markers; user can pick detected / all / select-from-list / abort - `--yes` / `-y` flag to skip confirmation prompts (implied when not a TTY) ### Changed - `scripts/install.js` rewritten to mirror `npx impeccable skills install` UX: scan → list → confirm → link. Non-TTY environments fall back to "install for detected agents only" (CI-friendly)
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 95% confidence
- Finding
The README instructs users to run 'npx skill-cybernetic-thinking install' without pinning a version. 'npx' may download and execute the latest package from the registry at run time, so a compromised publisher account, typosquatted package, or malicious update could lead to arbitrary code execution on the user's machine.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 95% confidence
- Finding
This example command again uses 'npx skill-cybernetic-thinking install' without a version, which causes live retrieval and execution of whatever the registry currently serves. In documentation for agent skills, this is more sensitive because installation code is intended to modify local agent directories and can affect developer environments broadly.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 95% confidence
- Finding
The non-interactive example 'npx skill-cybernetic-thinking install -y' is still an unpinned runtime package execution. Because '-y' suppresses prompts, it can make accidental execution easier and reduces friction for potentially unsafe changes if a malicious package version is served.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 95% confidence
- Finding
This explicit-agent install example still executes an unpinned package from the npm registry. Unpinned execution creates supply-chain risk and can result in arbitrary code running with the user's privileges during installation.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 95% confidence
- Finding
The custom-path installation command is unpinned and therefore subject to the same supply-chain execution risk as the other 'npx' examples. Since it targets arbitrary directories, a malicious package could abuse that flexibility to plant files in sensitive locations if a user follows the example with elevated trust.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 95% confidence
- Finding
This '--global' install example invokes an unpinned package, exposing users to registry-supplied code execution risk. Global installation context increases blast radius because modifications affect multiple projects or user-wide agent behavior.
- Content