Ship Paid App

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:03 AM UTC
• Version: 1.0.1

Overview

This deployment skill is mostly coherent, but it uses a mutable global CLI install and authenticated public deployment/billing authority that users should review before installing.

Install only if you intend to let SettleMesh deploy source code to a public URL and use metered resources. Prefer a reviewed pinned CLI version, confirm deployments and spending explicitly, use narrowly scoped or short-lived credentials where possible, and avoid running it in directories containing unrelated private files or secrets.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:35

Finding

Unpinned Global Installation of a Privileged Deployment CLI

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 35
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code

bash

npm install -g settlemesh@latest

Technical Analysis

The setup procedure installs the mutable latest release of the settlemesh npm package globally. It does not pin a reviewed version, verify an integrity digest, use a lockfile, or otherwise constrain the code that will be installed and executed.

This CLI is subsequently trusted with sensitive capabilities: access to SETTLE_API_KEY, authentication-session caching, reading and uploading application source, receiving deployment secrets, and managing billed infrastructure. npm installation may also execute package lifecycle scripts with the invoking user's privileges. Consequently, compromise of the package publisher, registry account, package distribution channel, or a future latest release could introduce arbitrary local code execution.

The audit found no evidence that the currently referenced package is malicious. The vulnerability is the unsafe, mutable dependency acquisition process.

Attack Path

1. An attacker compromises the npm package publisher, its release pipeline, or another component of the package distribution channel.
2. The attacker publishes a malicious release that becomes the package's latest version.
3. A user or agent follows the skill and runs npm install -g settlemesh@latest.
4. Malicious package installation scripts may execute immediately with the user's privileges.
5. The installed CLI can access the project source and deployment credentials during subsequent commands.
6. The attacker may exfiltrate source code or credentials, alter deployments, or abuse resources available through the authenticated account.

Impact Assessment

Successful exploitation could provide arbitrary code execution under the account that performs the global installation. The accessible scope may include:

• The `SET ...[truncated 501 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace @latest with an exact, reviewed version, for example:

   bash

   npm install -g settlemesh@X.Y.Z
   

2. Record and verify the expected package integrity digest and document the canonical npm registry and publisher identity.

3. Avoid global installation where possible. Prefer an isolated, project-scoped dependency governed by a committed lockfile and invoked through a controlled package script.

4. Disable npm lifecycle scripts during installation when they are unnecessary:

   bash

   npm install --ignore-scripts --save-exact settlemesh@X.Y.Z
   

   If lifecycle scripts are required, review them before installation rather than disabling them blindly.

5. Run the CLI in a least-privilege environment with access limited to the intended project directory and only the credentials required for that deployment.

6. Establish a controlled upgrade process that reviews release notes, package contents, publisher provenance, and integrity information before changing the pinned version.

7. Use short-lived, narrowly scoped deployment credentials where supported, and rotate credentials after any suspected package-channel compromise.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The description expands scope beyond deployment into generic app-building and productization requests, including adding auth, a database, and turning agent-written code into a real product. That ambiguity can cause the skill to be selected for requests that are exploratory or developmental rather than explicitly operational, increasing the risk of unintended provisioning, credential use, public exposure, and spend.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The description expands scope beyond deployment into generic app-building and productization requests, including adding auth, a database, and turning agent-written code into a real product. That ambiguity can cause the skill to be selected for requests that are exploratory or developmental rather than explicitly operational, increasing the risk of unintended provisioning, credential use, public exposure, and spend.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.