biz-in-a-box

• Outcome: Review
• Latest audit: Sep 11, 2026 · 12:44 AM UTC
• Version: 1.0.0

Overview

The skill is coherent for managing a business ledger, but its quickstart tells users to clone a mutable GitHub repo and run a validation script that is not included in the reviewed artifact.

Review or pin the GitHub repository before running `node validate.js`, preferably in an isolated working directory or container without unrelated credentials or sensitive files. The accounting protocol text itself is low risk, but executing the remote validator should be treated like running third-party code.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:24

Finding

Unpinned Remote Payload Retrieval and Execution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 24–29 and 41–45
Vulnerability Type: Mutable remote code retrieval followed by local execution
Risk Level: High

The skill instructs users or agents to clone an external GitHub repository and subsequently execute a JavaScript validation script from the retrieved content:

bash

git clone https://github.com/taylorhou/biz-in-a-box my-entity
cd my-entity

bash

node validate.js

Technical Analysis

The Git clone command retrieves the repository's current default branch without pinning it to a reviewed commit hash or verifying its integrity through a checksum or cryptographic signature. The later node validate.js command executes code obtained from that mutable remote source.

The validate.js file is not included in the audited skill package, so its implementation and security properties cannot be verified from the available project files. Because the effective executable payload can change after this skill has been reviewed, control of the upstream repository, its maintainers' credentials, or its delivery path can provide an attacker with a remote code execution channel.

This is best classified as remote payload retrieval and execution rather than a confirmed malicious dependency: the vulnerable behavior is the direct acquisition and execution of mutable remote code.

Attack Path

1. An attacker compromises the upstream GitHub repository, a maintainer account, or another mechanism capable of changing its default branch.
2. The attacker modifies validate.js or related code loaded by that script to include a malicious payload.
3. A user or agent follows the documented Quickstart and clones the repository without selecting a trusted commit.
4. The user or agent runs node validate.js as instructed.
5. Node.js executes the attacker-controlled payload with the permissions and environment of the invoking process.

Impact Assessm

...[truncated 632 chars]

Remediation

View remediation

Remediation Suggestions

1. Include the required validation script directly in the skill package so it can be reviewed and versioned with the instructions.
2. If remote retrieval is necessary, pin the repository to a specific, reviewed full commit hash rather than executing the current default branch:

   bash

   git clone https://github.com/taylorhou/biz-in-a-box my-entity
   cd my-entity
   git checkout --detach <reviewed-full-commit-hash>
   

3. Verify the retrieved script or release artifact against a trusted SHA-256 checksum or cryptographic signature before execution.
4. Ensure that trust metadata, such as the expected commit and checksum, is maintained independently from the mutable repository content it authenticates.
5. Review the complete dependency graph and all files loaded by validate.js, not only the entry-point script.
6. Execute validation with least privilege in an isolated environment that does not expose unrelated credentials, sensitive environment variables, or writable host paths.
7. Document the exact reviewed version and require a new security review before updating the pinned commit or integrity value.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.