Automation Recipe Book

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:18 AM UTC
• Version: 1.0.2

Overview

This skill is an automation recipe helper, but it normalizes persistent automations and community installs without enough trust and approval controls.

Review any generated or imported recipe before saving or enabling it, especially community recipes. Avoid global or unpinned installs unless you trust the registry and package versions, and run recipes with only the minimum file, command, network, and credential access they actually need.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:107

Finding

Unverified Community Recipe Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:107
Vulnerability Type: Untrusted supply-chain component installation
Risk Level: Medium

bash

agent recipe install --from community --name trending-news-monitor

Technical Analysis

The Skill recommends installing an automation recipe from an unspecified community registry without requiring version pinning, publisher verification, a cryptographic signature, a checksum, or a manual security review.

This is particularly sensitive because the documented recipe system can invoke installed skills such as fetch, mail, and browser, and the Skill itself declares exec, read, and write tools. A community recipe may therefore define actions that process local files, contact external services, or execute commands under the permissions granted to the Agent.

Installing community content is not necessary for the core recipe-book and recipe-generation functionality. It expands the trust boundary and privileges beyond the minimum needed to provide reference material or generate local YAML recipes.

Attack Path

1. An attacker publishes a malicious recipe under the expected name or compromises the community registry or publisher account.
2. A user follows the documented agent recipe install --from community command.
3. The platform retrieves and installs the recipe without a documented integrity or publisher-verification step.
4. The imported recipe declares actions or dependencies that invoke privileged installed skills.
5. When enabled or triggered, those actions may access workflow data, read or modify files, execute commands, or transmit data through network-capable integrations.

Impact Assessment

The achievable privileges depend on the Agent platform and permissions assigned to the imported recipe. In the documented environment, potential scope includes:

• Invocation of installed network-capable or communication skills.
• Access to dat ...[truncated 451 chars]

Remediation

View remediation

Remediation Suggestions

• Require explicit user approval before retrieving, installing, enabling, or scheduling community recipes.
• Pin imported recipes to an immutable version or content digest.
• Verify cryptographic signatures and clearly identify the trusted publisher and registry.
• Display the complete recipe, declared dependencies, requested tools, network destinations, and required secrets before installation.
• Subject imported recipes and transitive skills to static validation and manual review.
• Deny tools by default and grant each recipe only the file, command, credential, and network access required for its declared function.
• Run third-party recipes in an isolated environment with restricted filesystem and network access.
• Do not automatically enable or schedule an imported recipe after installation.
• Maintain an allowlist of approved recipes and publishers for enterprise deployments.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:202

Finding

Unpinned Third-Party Package Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:202-203
Vulnerability Type: Unpinned and globally installed dependencies
Risk Level: Medium

markdown

| PyYAML | Python library | Required for recipe parsing | `pip install pyyaml` |
| Mermaid CLI | Tool | Required for visualization | `npm install -g @mermaid-js/mermaid-cli` |

Technical Analysis

The installation commands resolve the latest package versions available from the configured Python and npm registries. They do not pin versions, verify hashes, enforce lockfiles, or identify an approved registry. Consequently, the effective dependency code can change after the Skill has been audited.

The Mermaid CLI command additionally uses a global npm installation, increasing the installation scope and potentially exposing the package's executables to unrelated users and projects. Package installation normally runs package build or lifecycle behavior, so a compromised registry account, dependency, package release, or registry configuration could introduce attacker-controlled code during installation.

The packages may be legitimate, but the documented installation method lacks controls needed to make their acquisition reproducible and trustworthy.

Attack Path

1. An attacker compromises a referenced package, one of its transitive dependencies, a maintainer account, or the registry resolution path.
2. A user executes the unpinned pip install pyyaml or global npm install command.
3. The package manager resolves a compromised or unexpectedly changed release.
4. Attacker-controlled installation or package code executes with the privileges of the user running the package manager.
5. The installed component can affect recipe parsing or visualization and, for a global npm installation, may remain available across unrelated projects.

Impact Assessment

Successful exploitation could obtain the permissions of the account performing the installation. D ...[truncated 672 chars]

Remediation

View remediation

Remediation Suggestions

• Pin every direct dependency to a reviewed version.
• Use a lockfile and require cryptographic hash verification, such as Python requirements with --require-hashes.
• Record and review transitive dependency versions.
• Configure package managers to use an approved registry and reject unexpected sources.
• Replace the global npm installation with a project-local development dependency.
• Install dependencies in a dedicated virtual environment, container, or other least-privilege sandbox.
• Disable unnecessary package lifecycle scripts where compatible with the selected dependency.
• Add automated vulnerability, provenance, and integrity checks to dependency updates.
• Update dependencies through a controlled review process rather than resolving unrestricted latest releases during setup.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The manifest-style description lacks precise invocation boundaries and does not clearly state when the skill must not be used. Because the skill exposes powerful automation concepts and declares read/exec/write tools, vague trigger scope can route unrelated requests into a capability set that may modify local automation state or propose risky operations without clear user intent.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The manifest-style description lacks precise invocation boundaries and does not clearly state when the skill must not be used. Because the skill exposes powerful automation concepts and declares read/exec/write tools, vague trigger scope can route unrelated requests into a capability set that may modify local automation state or propose risky operations without clear user intent.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The description explicitly states '支持中文交互' and the display name and content are Chinese-centric, but there is no indication that language is optional or user-selectable. This can violate language/locale policy expectations when a skill appears to force a specific language without opt-in.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill promotes exporting, importing, and installing community recipes but does not warn that imported recipes may contain actions that read files, call external services, or execute commands through the broader automation platform. In this context, shared recipes are effectively untrusted automation code/configuration, so normalizing community install flows without trust guidance materially increases supply-chain and system-impact risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The example states that a generated recipe is saved to a local path and asks whether to enable it, but the skill description does not clearly warn upfront that generation may create persistent local files and could later change automation behavior. For a skill with write and exec capabilities, silently normalizing save-first behavior can lead users to unknowingly accumulate or activate automations that affect data, notifications, schedules, or downstream systems.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The prominent feature callout emphasizes Chinese interaction, but the document does not mention multilingual support, user choice, or a justified regional limitation. In the absence of opt-in language selection, this can be read as a forced locale preference.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.