Anygen Task Download

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 7:51 AM UTC
• Version: 1.0.0

Overview

The skill is a small, purpose-aligned AnyGen download helper that discloses its API key requirement and local file writes, with a supply-chain caution around its unpinned CLI dependency.

Before installing, verify that @anygen/cli comes from the expected publisher and consider pinning or locking the reviewed version. Use a narrowly scoped ANYGEN_API_KEY where possible and choose the output directory deliberately because the command writes downloaded files to disk.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:5

Finding

Unpinned Third-Party CLI Dependency Executes with API Credentials

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 5-12
Vulnerability Type: Unpinned executable dependency
Risk Level: Medium

yaml

metadata:
  requires:
    bins: ["anygen"]
    env: ["ANYGEN_API_KEY"]
  install:
    - id: node
      kind: node
      package: "@anygen/cli"
      bins: ["anygen"]

Technical Analysis

The skill installs the third-party npm package @anygen/cli without specifying an exact version, lockfile, or integrity hash. Consequently, installation can resolve mutable registry content that was not present in the audited project and could change after this skill has been reviewed.

npm package installation may execute package lifecycle scripts. The installed anygen executable is then trusted to operate in an environment containing ANYGEN_API_KEY and to write downloaded artifacts to the local filesystem. Because neither the package implementation nor a cryptographic integrity constraint is included, the effective executable behavior cannot be verified from this project.

This is a supply-chain exposure rather than evidence that the current package is malicious. Exploitation would require compromise, replacement, or malicious publication of a version resolved under the package name.

Attack Path

1. An attacker compromises the npm package, its publisher account, or its distribution path and publishes attacker-controlled content under @anygen/cli.
2. The skill installer resolves the unpinned package to the compromised release.
3. Attacker-controlled code executes through an npm lifecycle script or when the installed anygen binary is invoked.
4. The code reads environment variables available to the process, potentially including ANYGEN_API_KEY.
5. The code can transmit accessible credentials or data, alter downloaded artifacts, or perform filesystem operations with the invoking process's permissions.

Impact Assessment

Successful exploitation could provide arbitrary code execution with the privileg ...[truncated 496 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin @anygen/cli to a specific, reviewed version instead of allowing mutable version resolution.
2. Use a committed lockfile and verify the package's registry integrity hash during installation.
3. Obtain the package only from a documented, trusted registry and enable provenance or signature verification where supported.
4. Review the pinned package source and its transitive dependencies before deployment.
5. Disable npm lifecycle scripts during installation where operationally feasible, or explicitly audit every required lifecycle script.
6. Run the CLI in a sandbox with only the required output directory mounted as writable.
7. Expose ANYGEN_API_KEY only to the command that requires it, use a narrowly scoped credential, and avoid inheriting unrelated secrets.
8. Add dependency monitoring and require security review before changing the pinned version.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.