OpenboardCLI

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 8:03 PM UTC
• Version: 1.0.0

Overview

This skill gives disclosed, purpose-aligned instructions for using OpenBoardCLI, but users should be careful with the global npm install and mutable remote command reference.

Install only if you trust the OpenBoardCLI npm package and its publisher, avoid administrator installs, prefer local-only mode when you do not want financial data or receipt contents leaving your machine, and review any live remote command reference before following commands that use credentials or transmit data.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:22
• Finding: Unpinned Global Installation of a Third-Party npm Package## Vulnerability Details **File Location**: `SKILL.md:22-26` **Vulnerability Type**: Unverified third-party dependency installed globally **Risk Level**: Medium **Vulnerable Code Snippet**: ```bash Install globally and verify: ```bash npm install -g openboard-cli openboard --version openboard --help ``` ``` ### Technical Analysis The Skill directs users to install the latest available version of `openboard-cli` globally without pinning a reviewed version, checking package integrity, validating publisher provenance, or using a lockfile. npm installation can execute package lifecycle scripts with the permissions of the invoking user. The `-g` option increases the installation scope beyond what is necessary to run the declared functionality. Although the artifact contains no evidence that the current package is malicious, this installation method leaves future executions exposed to npm account compromise, malicious package releases, dependency confusion within the package's dependency tree, and other supply-chain attacks. ### Attack Path 1. An attacker compromises the npm publisher account, package release process, or a transitive dependency. 2. The attacker publishes a malicious version that includes hostile runtime behavior or npm lifecycle scripts. 3. A user follows the Skill and runs `npm install -g openboard-cli` without a version constraint. 4. npm resolves and installs the attacker-controlled release. 5. Malicious installation or runtime code executes with the invoking user's permissions. 6. The code can attempt to access financial input files, Gmail-derived receipt data, environment variables, local configuration, or credentials available to that user. ### Impact Assessment Successful exploitation could provide arbitrary code execution under the installing user's account. The accessible scope may include invoice and receipt data, dashboard source files, cloud-provider tokens exposed to the process, a ...[truncated 265 chars]
• Remediation: ## Remediation Suggestions - Pin `openboard-cli` to a specifically reviewed version rather than resolving the latest release. - Verify npm publisher identity, package provenance, integrity metadata, and release signatures where available. - Prefer a project-local installation recorded in a lockfile instead of a global installation. - Execute the tool through a locally pinned package script or equivalent controlled mechanism. - Review package lifecycle scripts and consider initially installing with scripts disabled while validating the package. - Avoid using `sudo` or an administrator shell for installation. - Run the CLI in a restricted environment with access only to the input files and credentials required for the selected operating mode. - Establish a documented upgrade process that reviews new versions before changing the pinned dependency.

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:42
• Finding: Operational Instructions Delegated to a Mutable Remote Contract## Vulnerability Details **File Location**: `SKILL.md:42` **Vulnerability Type**: Untrusted remote instructions incorporated into agent operation **Risk Level**: Medium **Vulnerable Code Snippet**: ```text Consult the live [agent command contract](https://openboard-site.vercel.app/llms.txt) when exact flags or current behavior matter. ``` The metadata at `SKILL.md:3` also identifies the same remote document as the agent command contract. ### Technical Analysis The audited Skill delegates exact command behavior to a live document hosted on an external Vercel site. That document is not included in the reviewed artifact, is not pinned to an immutable revision, and has no specified integrity check. As a result, the effective instructions followed by an agent can change after this Skill has been reviewed. If the hosting account, deployment pipeline, domain, or remote content is compromised, an attacker could introduce instructions that alter command selection, credential handling, data destinations, or the agent's immediate goals. This is an instruction-trust-boundary issue rather than confirmed remote code execution. The local Skill does not itself download and execute a code payload, but it encourages the agent to treat mutable external text as an authoritative command contract. ### Attack Path 1. An attacker gains control of the website account, Vercel deployment, source pipeline, domain, or content serving `llms.txt`. 2. The attacker modifies the contract to include unsafe flags, commands, credential requests, or instructions to upload sensitive financial data elsewhere. 3. An agent follows `SKILL.md` and retrieves the live contract when exact behavior is needed. 4. The agent treats the attacker-controlled content as authoritative operational guidance. 5. The agent may execute altered commands, disclose data, or handle credentials in a manner not represented in the audited Skill. ### Impact Assessment The potenti ...[truncated 491 chars]
• Remediation: ## Remediation Suggestions - Include the reviewed command contract directly in the Skill package. - If remote retrieval is necessary, pin the contract to an immutable repository commit or versioned release. - Publish and verify a cryptographic hash or signature before using downloaded content. - Treat remote text as untrusted reference data, not as higher-priority agent instructions. - Explicitly prohibit remote content from changing safety constraints, requesting secrets, selecting new data destinations, or authorizing additional tools. - Apply an allowlist of supported subcommands and flags within the audited Skill. - Require explicit user confirmation before any command transmits financial data or uses GitHub, Vercel, Gmail, or cloud-LLM credentials. - Fail safely when the pinned contract cannot be retrieved or validated rather than falling back to an unverified live version.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.