poink-semantic-search

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 9:19 AM UTC
• Version: 1.0.2

Overview

The skill is a small wrapper for installing and using the Poink document-search CLI, with no artifact evidence of hidden or malicious behavior.

Install only if you are comfortable using the poink-cli package to process local documents. Prefer reviewing or pinning the package version in controlled environments, and avoid indexing sensitive folders unless that is your explicit intent.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:9

Finding

Unpinned Third-Party CLI Dependency

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 9–12
Vulnerability Type: Unpinned third-party package installation
Risk Level: Medium

yaml

install:
  - kind: node
    package: poink-cli
    bins:
      - poink

Technical Analysis

The skill instructs the platform to install poink-cli from the Node.js package ecosystem without specifying an exact version or an integrity hash. Consequently, installation may resolve to package contents that differ from those originally reviewed. The referenced GitHub homepage does not cryptographically bind the installed registry artifact to a particular reviewed source revision.

This creates a supply-chain trust risk: compromise of the package publisher account, registry package, release process, or a subsequently published package version could introduce malicious installation or runtime behavior. Package lifecycle scripts, if enabled by the installer, may execute during installation, while the installed poink executable runs when the skill uses it.

Attack Path

1. An attacker compromises the poink-cli publishing account, release pipeline, or package distribution channel.
2. The attacker publishes a malicious version under the expected package name.
3. A user or agent installs the skill after that version becomes the version selected by the package resolver.
4. Because no exact version or integrity digest is declared, the installer retrieves the attacker-controlled release.
5. Malicious package lifecycle code may execute during installation, or malicious logic may execute when the agent invokes poink.
6. That code operates with the permissions of the account performing the installation or running the CLI.

Impact Assessment

Successful exploitation could allow arbitrary code execution with the privileges of the installing or invoking user. Within those privileges, a malicious release could access local documents processed by the skill, read user-accessible credentials and con ...[truncated 348 chars]

Remediation

View remediation

Remediation Suggestions

• Pin poink-cli to an exact, reviewed version rather than allowing mutable version resolution.
• Verify the package with a trusted integrity digest or lockfile and fail installation when verification does not match.
• Validate package provenance, publisher ownership, and the relationship between the registry artifact and the referenced source repository.
• Review the selected release and its transitive dependency tree before distribution.
• Disable package lifecycle scripts during installation where operationally feasible.
• Execute installation and the resulting CLI under a sandboxed, least-privileged account with access only to documents required for the task.
• Establish a controlled update process in which new versions are reviewed and integrity metadata is updated explicitly.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.