Security audit

Package Version Tracker

Security checks for vulnerabilities and agentic risk

Overview

This skill coherently queries public npm and PyPI package version data, with limited and disclosed network use and no evidence of hidden persistence, credential access, or destructive behavior.

Before installing, consider narrowing the activation triggers if you do not want ordinary package-version discussions to make registry requests. Treat displayed package descriptions, authors, and summaries as untrusted registry content.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/package_version_tracker.py:130
Finding: Untrusted Registry Metadata Is Rendered Without Sanitization
Content: View full analysis
Remediation: View remediation
str: text = "" if value is None else str(value) text = ANSI_ESCAPE.sub("", text) text = CONTROL_CHARS.sub("", text) return text[:max_length] ``` 8. Apply the sanitizer immediately after parsing the registry response and perform context-specific Markdown escaping at the final rendering sink. ]]>

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill documentation is entirely presented in Chinese, including the feature descriptions and usage guidance, with no indication that users may choose another language or that the skill is intentionally limited to a Chinese-speaking context. This can constitute a language/locale policy issue because it implicitly constrains interaction language without opt-in.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The trigger phrases include very broad terms like "package version", "pypi 版本", and especially "pip show", which can match ordinary user requests without clearly constraining invocation to this specific skill. Overbroad triggers increase the chance of unintended activation, misrouting user requests, and causing the agent to perform network lookups when the user did not explicitly intend to use this capability.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The trigger set includes multiple ambiguous phrases such as general package/version references and terms like 'pip show', which may appear in normal technical discussions without the user intending to run this skill. In this context, ambiguous activation increases the chance of unsolicited network access and unintended skill execution during routine developer conversations.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The trigger phrase at line 26 is broad enough to match ordinary conversation about package versions rather than an intentional skill invocation. Because this skill has network permission, accidental activation could cause unintended external requests and expose user queries or context to remote package registries.
Content: No source excerpt is available for this finding.