Maay

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:01 PM UTC
• Version: 1.0.0

Overview

The skill’s purpose is clear, but it tells users or agents to run an unpinned remote CLI and source a generated shell config while handling paid-service credentials.

Review carefully before installing. Use a pinned and trusted ATXP CLI version, avoid exposing or printing `ATXP_CONNECTION`, and inspect or safely parse `~/.atxp/config` rather than blindly sourcing it in a shell or agent session.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:17

Finding

Execution of an Unpinned npm Package and Unvalidated Shell Configuration

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 17-18
Vulnerability Type: Unpinned third-party dependency execution and unsafe shell configuration loading
Risk Level: Medium

Vulnerable Code

bash

# Check if authenticated
echo $ATXP_CONNECTION

# If not set, login:
npx atxp login
source ~/.atxp/config

Technical Analysis

The authentication instructions execute atxp through npx without specifying a reviewed package version or enforcing an integrity constraint. Depending on the local npm environment, npx atxp login can download and execute the version currently resolved from the configured npm registry. The effective executable can therefore change after this Skill has been reviewed.

The following instruction sources ~/.atxp/config directly into the active shell. Shell source does not treat the file as passive configuration data: it executes every shell expression in the file with the user's privileges. Because the file is created or modified as part of the preceding package-driven login process, a compromised or unexpectedly changed package could place arbitrary commands in it.

No evidence establishes that the current atxp package or generated configuration is malicious. The vulnerability is the absence of package version and integrity controls combined with execution of an unvalidated generated shell file.

Attack Path

1. An attacker compromises the npm package, its publisher account, the package distribution process, or the registry resolution path.
2. The attacker publishes or causes resolution of a malicious atxp release.
3. A user follows the Skill instructions and runs npx atxp login.
4. npx retrieves and executes the attacker-controlled package under the user's account.
5. The malicious package can execute commands immediately or write shell commands into ~/.atxp/config.
6. The user runs source ~/.atxp/config, causing any injected shell commands t ...[truncated 676 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin atxp to a specifically reviewed version instead of resolving the latest available release:

   bash

   npx --yes atxp@<reviewed-version> login
   

2. Install dependencies through a lockfile that records exact versions and integrity hashes. Use a reproducible installation mechanism such as npm ci where applicable.
3. Verify package provenance, publisher identity, signatures or attestations, and integrity metadata before execution.
4. Do not source a package-generated file as unrestricted shell code. Store the connection value in a data-only format and parse only the expected field.
5. Validate that the configuration file is owned by the current user, has restrictive permissions, is not a symbolic link, and contains only the expected variable before loading it.
6. If shell export syntax is unavoidable, display and review the generated file before use and reject command substitutions, redirections, additional commands, shell functions, and unexpected variable names.
7. Run authentication tooling with least privilege and never invoke these instructions through sudo or a privileged service account.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (9)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 86% confidence

Finding

The manifest-level description includes a command reference to npx atxp login without version pinning, normalizing execution of an unpinned remote package. Even in descriptive metadata, this can propagate insecure operational guidance and contributes to supply-chain risk in downstream consumers of the skill.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence

Finding

The skill instructs users to run npx atxp without pinning a specific package version. npx resolves and may fetch the latest published package at execution time, creating a supply-chain risk where a compromised or malicious update could execute arbitrary code in the user's environment. Because this skill also deals with authentication, compromise could expose API credentials or local data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The authentication section tells users to inspect and source credential-related state via $ATXP_CONNECTION and source ~/.atxp/config without warning that these values are sensitive. In an agent or shared-shell context, this increases the chance of credential disclosure through logs, terminal history, prompt capture, or sourcing of a file whose contents have not been validated. The surrounding context makes this more dangerous because the skill is explicitly designed to authenticate against paid external services.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence

Finding

The login instruction uses npx atxp login without a fixed version, which means authentication is performed through whatever package version npx resolves at runtime. If that package is swapped, typosquatted, or later compromised, it could steal credentials or alter the authentication flow before sourcing the generated config.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 89% confidence

Finding

The command example npx atxp search <query> executes an unpinned package from the registry. This creates avoidable remote code execution and supply-chain exposure whenever the search tool is invoked, especially risky in an agent skill that may encourage frequent command execution.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 89% confidence

Finding

The image generation command uses npx atxp image <prompt> without version pinning. An attacker controlling or compromising the package release path could execute arbitrary code on the host under the guise of generating media.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 89% confidence

Finding

The music generation example invokes an unpinned npx package, exposing users to the same supply-chain risk as the other commands. Because npx may fetch fresh code at runtime, a malicious update could perform actions unrelated to the documented media task.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 89% confidence

Finding

The video generation command executes npx atxp video <prompt> without fixing the package version. This permits silent code changes over time and increases the chance of malicious package execution in environments that trust the skill instructions.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 89% confidence

Finding

The X/Twitter search example also relies on an unpinned npx atxp invocation. This is dangerous because users may execute arbitrary registry-hosted code while expecting a simple search utility, and any compromise could access environment variables or local files.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.