Snyk Skill Scanner

• Outcome: Review
• Latest audit: Sep 11, 2026 · 4:32 AM UTC
• Version: 1.0.0

Overview

This skill is a straightforward security-scanner helper, but it tells users to run mutable external code and a remote shell installer without version pinning or verification.

Review this before installing. Prefer a pinned, reviewed version of snyk-agent-scan, avoid copy-pasting the curl | sh installer, and run scans with only the paths needed under a non-administrative account. There is no artifact evidence of deception, exfiltration, or destructive behavior, but the current instructions rely too heavily on mutable third-party code.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:64

Finding

Remote Installer Downloaded and Executed Without Verification

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:14

Finding

Unpinned Latest Package Releases Are Downloaded and Executed

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 99% confidence

Finding

The | sh pipeline is a direct command-chaining pattern that executes untrusted remote content without inspection. In the context of a security-focused skill, this is particularly risky because users may grant it extra trust and run the command on systems where compromise would expose credentials or source code.

Content

Scanner excerpt · SKILL.md (reported line 64)May include surrounding context.

brew install uv

Linux

curl -LsSf https://astral.sh/uv/install.sh | sh

text

## OpenClaw Skills Location

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence

Finding

The skill metadata instructs use of uvx snyk-agent-scan without pinning to a specific version, which allows execution of whatever package version is current at runtime. Because this skill explicitly runs external code for security auditing, an unexpected upstream change or package compromise could lead to execution of malicious or unreviewed code.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

This command uses @latest, which is effectively unpinned and causes the tool to fetch and execute the newest available release at runtime. In a security-scanning skill that users may trust and run routinely, this increases supply-chain risk if a bad release or account compromise occurs upstream.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

The documented MCP scan command also uses @latest, so execution is tied to whatever package version is published when the command is run. That creates a real supply-chain exposure because the skill's intended behavior is to execute external code directly on the host.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

Using @latest in the verbose scan example still results in unreviewed code execution from the network at runtime. The extra context does not mitigate the underlying risk; users may copy-paste this command exactly as shown.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

The JSON automation example is especially sensitive because it may be incorporated into scripts or CI, causing repeated automatic execution of the latest remote package. That broadens the blast radius of an upstream compromise beyond an interactive one-off command.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The custom-path example still invokes snyk-agent-scan@latest, so the path argument does not change the core issue: the command executes a dynamically resolved external package. Since the skill is meant to inspect local skill directories, a compromised upstream package could gain broad visibility into developer files.

Content

No source excerpt is available for this finding.

External Script Fetching

Low

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The Linux installation instruction fetches a remote script over the network and pipes it directly to a shell. This is dangerous because any compromise of the hosting site, transport, or script contents results in immediate arbitrary code execution on the user's machine.

Content

Scanner excerpt · SKILL.md (reported line 64)May include surrounding context.

brew install uv

Linux

curl -LsSf https://astral.sh/uv/install.sh | sh

text

## OpenClaw Skills Location

Static analysis

No suspicious patterns detected.