JavaScript SDK工具

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 10:46 AM UTC
• Version: 1.0.0

Overview

This is a plain SDK usage skill with expected install and API-call behavior, but users should treat its broad read/write/exec authority and unpinned npm install carefully.

Before installing, use it only in projects where adding the inference.sh SDK is intended, pin or lock the npm dependency if possible, review what prompts or files may be sent to the external service, and keep API keys in environment variables rather than source files.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:65

Finding

Unpinned npm Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:65 and repeated at SKILL.md:181
Vulnerability Type: Unpinned third-party dependency installation
Risk Level: Medium

Vulnerable Code

bash

npm install @inferencesh/sdk

Technical Analysis

The Skill instructs users or an agent with command-execution capability to install @inferencesh/sdk without specifying an exact version. No lockfile, package integrity hash, trusted registry configuration, or source-verification procedure is provided.

Consequently, npm resolves the package version from the configured registry at installation time. The installed code may differ from the version reviewed when the Skill was published. npm packages can also define lifecycle scripts that execute during installation with the privileges of the invoking user. This creates a supply-chain risk if the package publisher, publishing credentials, registry resolution, or a future package release is compromised.

The same unsafe installation instruction appears twice in the document, at lines 65 and 181.

Attack Path

1. An attacker compromises the package publisher account, package repository, publishing pipeline, or registry resolution path.
2. The attacker publishes a malicious version of @inferencesh/sdk or alters the version resolved by the unpinned package specification.
3. A user or agent follows the Skill and runs:

   bash

   npm install @inferencesh/sdk
   

4. npm downloads the attacker-controlled release.
5. Malicious package code may execute through an installation lifecycle script or later when the SDK is imported.
6. The payload operates with the permissions of the user or agent that invoked npm.

This is a conditional supply-chain exploitation path; the audited file does not establish that the current package is malicious.

Impact Assessment

Successful exploitation could allow arbitrary code execution under the invoking user's accoun ...[truncated 637 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the dependency to a reviewed exact version rather than relying on the registry's latest matching release:

   bash

   npm install --save-exact @inferencesh/sdk@<reviewed-version>
   

2. Provide and retain a reviewed package-lock.json containing npm integrity metadata, and use npm ci for reproducible installation.
3. Document the canonical package registry and upstream repository so users can verify package identity and avoid registry substitution.
4. Review package contents and lifecycle scripts before approving a version.
5. Where compatible with the package, disable lifecycle scripts during installation:

   bash

   npm ci --ignore-scripts
   

6. Run dependency installation in a restricted environment with minimal filesystem access, no unnecessary credentials, and constrained network permissions.
7. Add automated dependency scanning and publisher/provenance verification to the release process.
8. Update both occurrences of the installation command at SKILL.md:65 and SKILL.md:181 so the documentation consistently uses the hardened installation procedure.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill says to use it whenever AI model calls, chat, agent orchestration, or LLM apps are needed, which is overly broad and underspecified for a skill that exposes read, write, and exec capabilities. Broad activation criteria can cause an agent to invoke this skill in unrelated contexts, increasing the chance of unnecessary command execution, file modification, or external API use without clear user intent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill advertises read, exec, and write tools and external SDK/API usage, but the early description does not clearly warn that using the skill may execute system commands, modify local files, and transmit data to third-party services. This can mislead users or orchestrating agents into invoking a high-privilege skill without understanding the system-state and data-exposure consequences.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.