Skill

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:55 PM UTC
• Version: 0.5.1

Overview

The skill is a coherent Graz city-info CLI wrapper, but it installs and runs an unpinned third-party npm package globally or via npx, so the reviewed artifact does not define the code that will execute.

Review this skill before installing. Prefer a pinned, reviewed @grazy/cli version installed in an isolated project or sandbox rather than global npm install or unversioned npx, and avoid running it where sensitive files or credentials are exposed.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:11

Finding

Unpinned Third-Party npm Package Installation and Execution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 11–20 and 51–55
Vulnerability Type: Supply-chain risk from an unpinned third-party dependency
Risk Level: Medium

Complete Code Snippet:

yaml

"requires":
  {
    "bins": ["grazy"],
    "npmPackages": ["@grazy/cli"],
  },
"install":
  [
    {
      "id": "node",
      "kind": "node",
      "package": "@grazy/cli",
      "label": "Install grazy CLI (npm)",
      "description": "Installiert die grazy CLI global: npm install -g @grazy/cli"
    },
  ],

bash

Die CLI ist bereits global installiert: `npm install -g @grazy/cli`

Oder alternativ mit npx (sandbox):
```bash
npx @grazy/cli events

text

### Technical Analysis

The skill declares, installs, and executes `@grazy/cli` without specifying an exact reviewed version or package-integrity hash. Consequently, the code executed by the skill may change whenever the npm registry package is updated.

Both documented installation mechanisms carry supply-chain risk:

- `npm install -g @grazy/cli` retrieves the registry-selected package release and can execute npm lifecycle scripts with the permissions of the invoking user. Global installation also modifies the user's wider Node.js environment.
- `npx @grazy/cli events` may retrieve and immediately execute a registry release that was not part of this audit.
- The provided npm and GitHub links identify the claimed project but do not cryptographically establish that the downloaded npm artifact corresponds to reviewed source code.

The audited project contains only `SKILL.md`; the implementation of `@grazy/cli` is not included. Therefore, the package's lifecycle scripts, network behavior, command construction, file access, and runtime implementation could not be independently reviewed. This finding does not establish that the current package is malicious; it identifies an unsafe dependency-resolution and execution mechanis
...[truncated 1420 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin @grazy/cli to a specific, reviewed version in both metadata and command examples, rather than allowing npm to select the current release.
2. Record and validate the package integrity digest using a lockfile or an equivalent cryptographic verification mechanism.
3. Vendor the reviewed implementation with the skill, or retrieve it only from a trusted immutable artifact repository.
4. Review the resolved package, its transitive dependencies, and all npm lifecycle scripts before deployment.
5. Avoid global installation. Install the package in an isolated project directory or disposable sandbox with minimal filesystem and network permissions.
6. Disable lifecycle scripts with --ignore-scripts when the verified package does not require them.
7. Replace unversioned npx @grazy/cli examples with invocation of a locally locked dependency or an explicitly pinned package version.
8. Run the CLI under a dedicated, unprivileged account without access to secrets, sensitive files, or privileged system interfaces.
9. Establish dependency monitoring and require review before updating the pinned package or its transitive dependency graph.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence

Finding

The skill instructs use of npx @grazy/cli without pinning a specific package version, which makes execution depend on whatever version is current in the registry at run time. If the package is updated maliciously, compromised, or a breaking version is published, an agent could fetch and run unreviewed code automatically.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The instruction "Immer English Commands verwenden" imposes a language requirement in the skill's natural-language guidance. There is no accompanying user choice, opt-in, or justification that this locale/language restriction is required for a region-specific compliance or similar policy need.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.