Microsoft Skill Creator

• Outcome: Review
• Latest audit: Sep 10, 2026 · 6:59 PM UTC
• Version: 1.0.1

Overview

The skill is coherent and not malicious, but it tells agents to run or globally install an unpinned npm CLI package as a fallback, which deserves review before installation.

Review this skill before installing. It appears intended to build Microsoft-focused skills and does not show deception or exfiltration, but agents following it may run or globally install a mutable npm package. Prefer MCP tools, pin and vet any CLI version, avoid global installs where possible, and run the fallback only in a controlled environment.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:38

Finding

Execution and Global Installation of an Unpinned npm Dependency

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:38-42; duplicated guidance in references/skill-templates.md:12-13
Vulnerability Type: Unpinned third-party package retrieval and execution
Risk Level: Medium

Vulnerable Code

From SKILL.md:38-42:

sh

# Run directly (no install needed)
npx @microsoft/learn-cli search "semantic kernel overview"

# Or install globally, then run
npm install -g @microsoft/learn-cli

Corresponding guidance from references/skill-templates.md:12-13:

markdown

Run directly with `npx @microsoft/learn-cli <command>` or install globally with `npm install -g @microsoft/learn-cli`.

Technical Analysis

The skill instructs agents to retrieve and execute @microsoft/learn-cli without specifying an audited version or validating package integrity. Consequently, package resolution depends on the mutable state of the npm registry at execution time.

The npx command may download and immediately execute the package's current resolved release. The global installation alternative also downloads mutable third-party code and installs it into the user's global npm environment. Package code and installation lifecycle behavior can therefore differ from what existed when this skill was audited.

This creates a supply-chain trust boundary: compromise of the package, publisher account, npm distribution process, or a future package release could cause agents following the documented fallback to execute attacker-controlled code. No evidence establishes that the current package is malicious; the vulnerability is the unsafe, unpinned execution pattern.

Attack Path

1. An attacker compromises the package publisher account, package repository, release pipeline, or another relevant npm distribution component.
2. The attacker publishes a malicious version of @microsoft/learn-cli, potentially including malicious CLI logic or installation lifecycle scripts.
3. An agent ...[truncated 1256 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the dependency to a reviewed exact version rather than resolving the latest available release:

   sh

   npx --yes @microsoft/learn-cli@EXACT_AUDITED_VERSION search "semantic kernel overview"
   

2. Prefer declaring the CLI in a project manifest and committing a lockfile so package versions and transitive dependencies are reproducible.

3. Use npm integrity metadata and a trusted internal registry or approved package proxy where available.

4. Remove the recommendation to install the package globally. Execute a locally locked dependency through a package script or equivalent controlled environment.

5. Review package provenance, publisher identity, lifecycle scripts, and release signatures before approving version updates.

6. Run the CLI with least privilege in a sandbox or container that has restricted filesystem, credential, and network access.

7. Apply the same hardened command and version policy consistently in both SKILL.md and references/skill-templates.md.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The description says to use the skill whenever users want to create a skill that teaches agents about 'any Microsoft technology, library, framework, or service,' followed by a very broad set of examples. This activation scope is expansive and does not include exclusions or tighter constraints, increasing the chance of unintended invocation for general Microsoft-related conversations.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

The skill instructs agents to execute npx @microsoft/learn-cli without pinning a specific version, which allows retrieval and execution of whatever package version is current at runtime. This creates a supply-chain risk: if the package is compromised or a breaking/malicious version is published, an agent following the skill could execute unreviewed code.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

This repeated guidance again recommends npx @microsoft/learn-cli <command> without version pinning, so the same unpinned remote package execution risk applies in the generated skill template. Because it is embedded as boilerplate for downstream generated skills, it can propagate the unsafe pattern broadly.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The template instructs users to run npx @microsoft/learn-cli <command> without pinning a specific version. Because npx resolves and executes the latest published package by default, a compromised upstream release or unexpected breaking change could cause users to run unreviewed code, creating a supply-chain execution risk. In a skill-creation context, this guidance may be copied broadly, increasing blast radius.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.