Skills.sh Search

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 5:06 AM UTC
• Version: 1.0.4

Overview

This is a small skill-search CLI whose behavior is disclosed and purpose-aligned, with supply-chain and terminal-output risks users should handle cautiously.

Before installing or using --show-install output, review the discovered skill source, prefer pinned package versions where possible, and do not copy terminal-generated install commands unless the repository name looks valid and trusted.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:81

Finding

Unpinned Third-Party Package Execution Through npx

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 81-89
Vulnerability Type: Supply-chain exposure through unpinned executable packages
Risk Level: Medium

Vulnerable Code

bash

npx @thesethrose/skills-search "react"

The documentation subsequently instructs the user to install a discovered skill:

bash

npx skills add vercel-labs/agent-skills

Technical Analysis

The documented commands invoke npx packages without pinning exact reviewed versions. When the relevant package is unavailable locally, npx can retrieve its current release from the package registry and execute it. Consequently, the code executed when following these instructions can differ from the version that was present during this audit.

The installation workflow also extends trust to mutable third-party skill repositories discovered through an external registry. There is no documented requirement to verify a package version, integrity digest, publisher identity, or downloaded skill contents before installation.

This creates a supply-chain trust boundary in which compromise of the package publisher, registry account, package namespace, or referenced repository can introduce attacker-controlled content after the current skill has been reviewed.

Attack Path

1. An attacker compromises the publisher account, package namespace, distribution channel, or referenced third-party repository.
2. The attacker publishes a malicious release or replaces mutable installation content.
3. A user or agent follows the documented unpinned npx command.
4. npx retrieves the current package version rather than a specifically reviewed version.
5. Package code executes with the permissions of the invoking user.
6. The malicious process can access files, environment variables, credentials, and network resources available to that user.

Impact Assessment

A compromised package executed by npx can run arbitrary code wi ...[truncated 456 chars]

Remediation

View remediation

Remediation Suggestions

• Pin every executable package to an exact reviewed version, for example by using an explicit package version instead of the mutable latest release.
• Use lockfiles and package integrity metadata where the installation workflow supports them.
• Avoid automatically executing packages obtained through search results.
• Require explicit user confirmation before installing any discovered skill or package.
• Verify package ownership, repository provenance, release signatures, and integrity hashes before execution.
• Review the contents and installation hooks of discovered skills before making them available to an agent.
• Run third-party installers in a restricted environment with minimal filesystem, credential, and network access.
• Document that package installation commands execute third-party code with the permissions of the invoking account.

T09 · Insecure Skill Coding Practices

Warning

• Location: cli.js:82

Finding

Unsanitized Remote Registry Data Emitted to Terminal and Installation Commands

Content

View full analysis

Vulnerability Details

File Location: cli.js, lines 82-89
Vulnerability Type: Terminal control-sequence injection and unsafe command generation
Risk Level: Medium

Vulnerable Code

js

results.forEach(skill => {
  console.log(`✅ ${skill.name} (${formatNumber(skill.installs)} installs)`);
  console.log(`   Source: ${skill.topSource}`);
  if (showInstall) {
    console.log(`   Install: npx skills add ${skill.topSource}`);
  }
  console.log('');
});

Technical Analysis

The values skill.name and skill.topSource originate from the remote skills registry response. They are interpolated directly into terminal output without schema validation, control-character removal, escaping, or enforcement of a safe repository-identifier format.

If a registry record or API response contains terminal escape sequences, the displayed output may be manipulated. Depending on terminal capabilities, crafted control sequences can alter visible text, conceal output, create misleading prompts, or otherwise spoof the command-line interface.

The --show-install path also embeds skill.topSource directly into a shell command presented to the user. The CLI does not execute this generated command itself, but shell metacharacters within a malicious source value could become executable syntax if the user copies and runs the displayed command.

Attack Path

1. An attacker creates or compromises a registry record, or otherwise gains influence over the API response.
2. The attacker places terminal control characters or shell metacharacters in name or topSource.
3. A user searches for the malicious record or requests popular skills.
4. The CLI prints the attacker-controlled values directly to the terminal.
5. Terminal sequences manipulate the presentation, or the CLI displays a crafted installation command.
6. If the user trusts and executes the crafted command, the embedded shell syntax can run attacker-se ...[truncated 686 chars]

Remediation

View remediation

Remediation Suggestions

• Validate the complete API response against a strict schema before using it.
• Restrict topSource to the expected repository identifier syntax, such as an allowlist of ASCII letters, digits, periods, underscores, and hyphens in an owner/repository structure.
• Reject values containing control characters, line breaks, escape bytes, whitespace, or shell metacharacters.
• Sanitize all remotely supplied text before writing it to a terminal.
• Clearly distinguish informational output from commands intended for execution.
• Prefer generating structured arguments rather than copyable shell command strings.
• If installation is later automated, invoke the executable directly with an argument array and with shell processing disabled.
• Require confirmation and display the validated repository identity before initiating installation.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (8)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 111)May include surrounding context.

md

Skills.sh automatically indexes GitHub repos containing `SKILL.md` files. To add your skill:

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 113)May include surrounding context.

md

Skills.sh automatically indexes GitHub repos containing `SKILL.md` files. To add your skill:

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The skill instructs users to run npx skills add vercel-labs/agent-skills without pinning a package version, which causes npm to fetch and execute whatever package version is current at runtime. If the package is compromised, typosquatted, or a malicious version is published later, users may execute attacker-controlled code during installation.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

This example again relies on unpinned npx skills, which executes a package resolved from the registry at invocation time. That creates a supply-chain risk because the behavior and code executed can change over time without review by the skill user.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The automation step tells users to run npx @thesethrose/skills-search "react" without an exact version. Because npx may download and immediately execute the latest published package, a compromised maintainer account or malicious update could lead to arbitrary code execution on the user's system.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The follow-up install command again uses unpinned npx skills, exposing users to the same mutable-registry execution risk. In this skill's context, the danger is somewhat elevated because the documented purpose is discovering and then installing more skills, increasing the chance of repeated trust in remote packages and expanding the attack surface.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.