CodeGraph Index

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:58 AM UTC
• Version: 0.1.0

Overview

The skill is a coherent code-indexing helper, but it can trigger broad workspace indexing and a global unpinned npm install without clear user confirmation.

Install only if you are comfortable with a skill that may scan the whole workspace for code structure. Before first use, prefer a pinned project-local `tree-sitter-cli` install, avoid elevated shells, and confirm before running repository-wide indexing or creating `.tree-sitter/` artifacts.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:23

Finding

Unpinned Global Installation of a Third-Party npm Package

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 23–25
Vulnerability Type: Supply-chain exposure through an unpinned global dependency
Risk Level: Medium

bash

# If it is not installed, install it with npm (CodeGraph supports Windows)
npm install -g tree-sitter-cli

Technical Analysis

The Skill instructs the user or agent to install tree-sitter-cli globally without specifying a reviewed version, lockfile, package integrity hash, or trusted registry. As a result, the package contents installed at execution time can differ from those reviewed when the Skill was published.

npm packages can execute lifecycle scripts during installation. If the package, its maintainer account, one of its transitive dependencies, or the configured npm registry is compromised, installation could execute attacker-controlled code with the privileges of the user running the command. The global -g installation also gives the installed package broader availability and impact than a project-local dependency.

The audit found no evidence that tree-sitter-cli is currently malicious. The vulnerability is the unsafe and non-reproducible dependency installation procedure.

Attack Path

1. An attacker compromises the npm package, a transitive dependency, a maintainer account, or the user's configured npm registry.
2. The attacker publishes or serves a modified package version containing a malicious lifecycle script or executable.
3. A user or agent follows the Skill instructions and runs npm install -g tree-sitter-cli.
4. npm retrieves the current package version rather than a version previously reviewed by the Skill author.
5. Malicious installation code executes with the invoking user's privileges.
6. The globally installed executable remains available to later commands and may access or modify resources available to that user.

Impact Assessment

Successful exploitation could provide arbitrary code executi ...[truncated 669 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the dependency to a specifically reviewed version instead of installing the latest release:

   bash

   npm install --save-dev --save-exact tree-sitter-cli@<reviewed-version>
   

2. Prefer a project-local installation over -g, and invoke it through the local package runner or node_modules/.bin.
3. Commit a lockfile and use npm ci to obtain reproducible dependency resolution.
4. Verify package provenance and integrity through a trusted registry, package-lock integrity metadata, and npm provenance information where available.
5. Review direct and transitive dependencies before approving version updates.
6. Run installation without elevated privileges and in a sandbox or isolated development environment when possible.
7. If lifecycle scripts are unnecessary, consider initially installing with --ignore-scripts, then explicitly enable only reviewed build steps.
8. Document the approved package version and update process in the Skill so agents do not automatically install an unreviewed future release.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The activation conditions combine vague user intents ('analyze project structure', 'find call relationships') with heuristics like source-file count and repository size, rather than requiring an explicit opt-in. That ambiguity can cause automatic execution of indexing workflows over large codebases, including dependency installation and broad file-system queries, even when the user's request could be satisfied more minimally. Because this skill is designed to inspect the entire workspace and build graphs, accidental activation materially expands access and operational scope.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The trigger command examples are very broad phrases such as '分析这个项目' and '了解代码结构', which commonly occur in normal coding assistance requests. This can cause the skill to activate in situations where the user did not explicitly request indexing, leading the agent to run repository-wide enumeration commands and possibly install tooling unnecessarily. In the context of a skill that shells out to tree-sitter, npm, PowerShell, and Python, overbroad activation increases the chance of unintended command execution and excessive workspace data exposure.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.