Snyk Skill Scanner

• Outcome: Review
• Latest audit: Sep 11, 2026 · 4:32 AM UTC
• Version: 1.0.0

Overview

This skill is a straightforward security-scanner helper, but it tells users to run mutable external code and a remote shell installer without version pinning or verification.

Review this before installing. Prefer a pinned, reviewed version of snyk-agent-scan, avoid copy-pasting the curl | sh installer, and run scans with only the paths needed under a non-administrative account. There is no artifact evidence of deception, exfiltration, or destructive behavior, but the current instructions rely too heavily on mutable third-party code.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:64
• Finding: Remote Installer Downloaded and Executed Without Verification<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:64` **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Critical ### Vulnerable Code ```bash curl -LsSf https://astral.sh/uv/install.sh | sh ``` ### Technical Analysis The installation instruction retrieves a mutable shell script from an external URL and immediately pipes it into `sh`. No version is pinned, and no cryptographic signature or checksum is verified before execution. Although HTTPS provides transport encryption and server authentication, it does not protect against compromise of the upstream server, domain, hosting account, release process, or installer content. Because the downloaded bytes are never stored for review, the effective payload can change after the Skill has been audited. Installing `uv` is ancillary to the declared security-scanning function. Direct remote-to-shell execution is not the minimum-privilege or minimum-risk method necessary to satisfy that dependency. ### Attack Path 1. An attacker compromises the installer host, publishing process, domain, or another component controlling `https://astral.sh/uv/install.sh`. 2. The attacker replaces or modifies the installer with malicious shell commands. 3. A user follows the Skill's Linux installation instructions. 4. `curl` retrieves the attacker's current payload. 5. The pipe sends the payload directly to `sh` without integrity verification or inspection. 6. The malicious commands execute with all privileges available to the invoking user. ### Impact Assessment Successful exploitation provides arbitrary command execution under the invoking user's account. The payload could read or alter user-accessible files, source code, credentials, SSH configuration, tokens, Agent configuration, and installed skills. It could also install persistence or modify other executable content where the user has write permission. The command does not inherently elevate privileges, but its scope includes the f ...[truncated 132 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Remove the direct `curl | sh` installation path. - Prefer a trusted operating-system package manager, such as the documented Homebrew method or an appropriate distribution repository. - If an upstream installer is unavoidable: 1. Pin a specific installer or release version. 2. Download it to a local file without executing it. 3. Obtain its expected checksum or signature through an independently authenticated channel. 4. Verify the artifact before execution. 5. Review the downloaded script. 6. Execute it as an unprivileged user and restrict its destination where possible. - Avoid silent installation instructions so users can inspect download and verification failures. - Document the files, directories, and environment changes the installer is expected to make. ]]>

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:14
• Finding: Unpinned Latest Package Releases Are Downloaded and Executed<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:14-23` **Vulnerability Type**: Insecure third-party dependency execution **Risk Level**: Medium ### Vulnerable Code ```bash # Scan all skills on the machine uvx snyk-agent-scan@latest --skills # Scan MCP servers (default behavior) uvx snyk-agent-scan@latest # Scan with verbose output uvx snyk-agent-scan@latest --skills --verbose # Output JSON for automation uvx snyk-agent-scan@latest --skills --json ``` ### Technical Analysis Every documented invocation selects `snyk-agent-scan@latest`. This mutable selector allows the resolved package version and executable code to change without any modification to the reviewed Skill. `uvx` executes the resolved third-party package rather than merely downloading passive data. Consequently, a compromised publisher account, malicious upstream release, package registry compromise, or compromised transitive dependency could convert an ordinary scan invocation into arbitrary local code execution. This behavior is especially sensitive because the scanner is instructed to inspect Agent components and potentially all installed skills. Those targets may contain proprietary prompts, configuration, or other sensitive content. Pinning an audited release is more consistent with least-change supply-chain controls than executing the latest release automatically. ### Attack Path 1. An attacker compromises the upstream package publisher, release process, package registry, or a dependency used by a future release. 2. A malicious version becomes the release resolved by `@latest`. 3. A user invokes one of the documented `uvx` commands. 4. `uvx` resolves and retrieves the malicious package version. 5. The package executes with the invoking user's privileges. 6. The package can access user-readable data and the skill or MCP paths supplied to the scan. ### Impact Assessment A malicious resolved package could execute arbitrary code with the invoking user's privileges. It c ...[truncated 432 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Replace `@latest` with an exact, reviewed version of `snyk-agent-scan`. - Test and approve new versions before updating the documented pin. - Use lockfiles or equivalent dependency constraints where supported so transitive dependencies are reproducible. - Verify downloaded package artifacts using registry integrity metadata, publisher signatures, or trusted checksums when available. - Document the expected registry and publisher identity to reduce dependency-confusion and source-substitution risk. - Run the scanner with only the filesystem paths it needs, under a non-administrative account. - Restrict unnecessary network access during scanning where operationally possible. - Avoid scanning every installed skill by default when a specific target path is sufficient. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Chaining Abuse

High

• Category: Tool Misuse

Content

brew install uv

# Linux
curl -LsSf https://astral.sh/uv/install.sh | sh
```

## OpenClaw Skills Location

• Confidence: 99% confidence
• Finding: The `| sh` pipeline is a direct command-chaining pattern that executes untrusted remote content without inspection. In the context of a security-focused skill, this is particularly risky because users may grant it extra trust and run the command on systems where compromise would expose credentials or source code.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence
• Finding: The skill metadata instructs use of `uvx snyk-agent-scan` without pinning to a specific version, which allows execution of whatever package version is current at runtime. Because this skill explicitly runs external code for security auditing, an unexpected upstream change or package compromise could lead to execution of malicious or unreviewed code.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence
• Finding: This command uses `@latest`, which is effectively unpinned and causes the tool to fetch and execute the newest available release at runtime. In a security-scanning skill that users may trust and run routinely, this increases supply-chain risk if a bad release or account compromise occurs upstream.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence
• Finding: The documented MCP scan command also uses `@latest`, so execution is tied to whatever package version is published when the command is run. That creates a real supply-chain exposure because the skill's intended behavior is to execute external code directly on the host.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence
• Finding: Using `@latest` in the verbose scan example still results in unreviewed code execution from the network at runtime. The extra context does not mitigate the underlying risk; users may copy-paste this command exactly as shown.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence
• Finding: The JSON automation example is especially sensitive because it may be incorporated into scripts or CI, causing repeated automatic execution of the latest remote package. That broadens the blast radius of an upstream compromise beyond an interactive one-off command.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence
• Finding: The custom-path example still invokes `snyk-agent-scan@latest`, so the path argument does not change the core issue: the command executes a dynamically resolved external package. Since the skill is meant to inspect local skill directories, a compromised upstream package could gain broad visibility into developer files.

External Script Fetching

Low

• Category: Supply Chain

Content

brew install uv

# Linux
curl -LsSf https://astral.sh/uv/install.sh | sh
```

## OpenClaw Skills Location

• Confidence: 98% confidence
• Finding: The Linux installation instruction fetches a remote script over the network and pipes it directly to a shell. This is dangerous because any compromise of the hosting site, transport, or script contents results in immediate arbitrary code execution on the user's machine.

Static analysis

No suspicious patterns detected.