find-skills scan submission

• Outcome: Review
• Latest audit: Sep 24, 2026 · 3:09 AM UTC
• Version: 1.0.0

Overview

The skill is not overtly malicious, but it guides agents toward globally installing and updating external skills with mutable commands and skipped confirmations.

Install only if you are comfortable with a skill that can lead the agent to fetch and globally install other skills. Review each recommended skill's source first, avoid blind `-y` installs in sensitive environments, and prefer pinned or locally vetted tooling where possible.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (15)

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The top-level description says the skill should be used whenever users seek functionality that might exist as an installable skill, which overlaps heavily with ordinary assistance requests. Overbroad triggers can cause the agent to invoke this skill unexpectedly, increasing exposure to external package search and installation flows even when unnecessary.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The activation conditions include broad prompts like 'how do I do X' and 'can you do X', with no clear exclusion criteria. That ambiguity can route many benign user requests into a workflow that recommends external code acquisition, creating unnecessary security risk and decision confusion.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence
• Finding: The skill repeatedly instructs use of `npx skills` without pinning an exact package version, which allows whatever version is currently published to be fetched and executed at runtime. Because this skill is specifically about discovering and installing more code from external sources, an upstream compromise or malicious update could lead to arbitrary code execution on the user's machine.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence
• Finding: Using `npx skills` without version pinning means the command may download and run the latest published package at execution time. In a package-manager style workflow, this creates a supply-chain risk where a compromised or typosquatted release could execute attacker-controlled code.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence
• Finding: This command reference invokes an external package manager entrypoint without locking the resolved version. If the published package changes or is compromised, users following the skill can execute unreviewed code directly from the registry.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence
• Finding: The update command is presented via unpinned `npx`, so both the bootstrap package and the update action depend on mutable upstream state. That increases exposure to supply-chain compromise and can silently introduce malicious code during routine updates.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence
• Finding: The search example uses `npx skills find` without constraining which package version will be executed. Even though this appears read-only, the underlying fetched package still runs locally and could perform arbitrary actions if malicious.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence
• Finding: This example encourages dynamic package execution from the registry with no version control. The surrounding context lowers user suspicion because it is framed as discovery/help text, making the supply-chain risk more dangerous in practice.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence
• Finding: The command example relies on unpinned `npx`, exposing users to execution of whatever package version is current at run time. Because the skill then helps locate and install additional code, a compromise here could cascade into broader system compromise.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence
• Finding: The unpinned invocation can fetch and run modified upstream code without notice. In a skill-discovery workflow, users may interpret this as a normal built-in operation rather than executing third-party code, increasing the chance of unsafe adoption.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence
• Finding: The install command `npx skills add ...` is especially sensitive because it both bootstraps an unpinned CLI and installs further external content. This compounds supply-chain risk and can result in arbitrary code execution or persistent installation of malicious skills.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The installation guidance recommends `-g -y` but does not prominently warn that this performs a global install and suppresses confirmation prompts. In this context, the omission is dangerous because the skill is guiding users toward installing third-party code, and silent global installation reduces friction for risky or mistaken actions.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence
• Finding: This command combines unpinned `npx` execution with global installation (`-g`) and automatic confirmation (`-y`), enabling silent persistent changes to the user's environment. If the package or target skill is compromised, the result could be unattended arbitrary code execution and durable system-level compromise within the user context.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence
• Finding: The suggestion to create a skill via unpinned `npx skills init` still executes mutable external code from the registry. While less immediately dangerous than installation, it normalizes unsafe package execution patterns throughout the skill.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence
• Finding: This line reinforces a pattern of unpinned `npx` usage for skill-related operations. Repetition across the document increases the likelihood that users will execute external code casually, amplifying supply-chain exposure.

Static analysis

No suspicious patterns detected.