Glin Profanity

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 7:41 AM UTC
• Version: 1.0.0

Overview

This skill is a straightforward profanity-filtering library guide, with the main caution being unpinned npm and pip install commands.

Install this like any third-party dependency: pin a reviewed version, use lockfiles or hashes where possible, and run it in the same least-privileged environment you would use for other application libraries.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:13

Finding

Unpinned Third-Party Package Installation Creates Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 13–19
Vulnerability Type: Unpinned dependencies installed from external package registries
Risk Level: Medium

Vulnerable Code

bash

# JavaScript/TypeScript
npm install glin-profanity

# Python
pip install glin-profanity

Technical Analysis

The installation instructions retrieve glin-profanity from npm or PyPI without specifying an exact version, integrity hash, lockfile, or other verification mechanism. Consequently, the code installed by users may differ from the version that was originally reviewed.

Package installation and subsequent imports can execute package-controlled code with the privileges of the invoking user. In the npm ecosystem, lifecycle scripts may execute during installation. Python packages may also execute package code during build or installation, depending on the package format and installer behavior.

The audited project contains only SKILL.md; it does not include the dependency's source code or controls that establish the integrity of the downloaded artifacts. This finding therefore represents an insecure dependency acquisition path, not evidence that the named package is currently malicious.

Attack Path

1. An attacker compromises the package publisher account, registry artifact, release workflow, or a transitive dependency.
2. The attacker publishes a malicious release under the expected package name.
3. A user follows the documented unpinned npm install or pip install command.
4. The package manager resolves the compromised release because no exact reviewed version or integrity constraint is specified.
5. Malicious code executes through an installation lifecycle hook, package build process, or later application import.
6. The payload operates with the permissions of the user or service performing the installation or running the application.

Impact Assessment

Successful exploitation could permit arbitrary code execution under the ...[truncated 461 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin each dependency to a reviewed, immutable version rather than relying on the latest registry resolution:

   bash

   npm install glin-profanity@<reviewed-version> --save-exact
   pip install glin-profanity==<reviewed-version>
   

2. Commit and enforce ecosystem lockfiles, such as package-lock.json for npm and a hash-locked requirements file for Python.

3. Require integrity verification:

   • Use npm lockfile integrity metadata and reproducible clean installation with npm ci.
   • Generate Python requirements with hashes and install using pip install --require-hashes.
   • Verify package publisher identity, release provenance, and signatures where available.

4. Audit the pinned package and its transitive dependencies before recommending it, including npm lifecycle scripts and Python build configuration.

5. Use automated dependency monitoring to identify compromised, deprecated, or vulnerable releases while ensuring that updates undergo review before deployment.

6. Perform package installation and runtime execution in a least-privileged, isolated environment without unnecessary credentials or access to sensitive host resources.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.