Security audit
Security checks for vulnerabilities and agentic risk
The skill is Nudgen-focused, but its documentation includes unverified remote install commands that can run mutable code on a user's machine.
Review the install commands before using this package. Prefer pinned versions, project-scoped installation, and checksum or signature verification; avoid running curl-to-bash or latest/default-branch installers in sensitive environments. Treat Nudgen PATs as secrets and confirm team context before any delete or write operation.
skills/cli/references/cli.md:25Mutable Remote Installer Is Executed Directly Through Bash
README.md:17Unpinned npx-Based Skill Installation Creates Supply-Chain Exposure
skills/cli/references/cli.md:28Unpinned Go and Source-Build Installation Executes Mutable Upstream Content
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
description: >
Use this skill whenever the user wants to integrate Nudgen from application
code, backend services, webhooks, or server-side automation. This includes
Nudgen API authentication with Personal Access Tokens (PATs), contacts,
campaigns, stats, teams, brand configs, and affiliate/referral endpoints.
Trigger on phrases like "Nudgen API", "send request to /api/v1", "Bearer
PAT", "create contact in backend", "switch team via API", or any request to
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Every request uses a Personal Access Token (PAT):
Authorization: Bearer <PAT>
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- `GET /contacts`
- `POST /contacts/add`
- `PATCH /contacts/:id`
- `DELETE /contacts/:id`
- Campaigns
- `GET /campaigns`
- `POST /campaigns`
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Campaigns
- `GET /campaigns`
- `POST /campaigns`
- `DELETE /campaigns/:id`
- Stats
- `GET /dashboard/overview`
- Teams
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- `GET /teams`
- `POST /teams`
- `POST /teams/switch`
- `DELETE /teams/:id`
- Brand config
- `GET /brand`
- `POST /brand`
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- `GET /brand`
- `POST /brand`
- `PATCH /brand/:id`
- `DELETE /brand/:id`
- Affiliate/referral
- `GET /affiliate/me`
- `GET /affiliate/analytics`
The | bash construct turns a network fetch into immediate shell execution, enabling command chaining abuse and making any compromise of the upstream content equivalent to arbitrary code execution on the user's machine. Because this is in a CLI reference skill, the likelihood of copy-paste execution is elevated, which makes the guidance materially more dangerous.
curl -fsSL https://raw.githubusercontent.com/Nudgen-Marketing/nudgen-cli/main/scripts/install.sh | bash
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- starts local callback receiver on port `3456`
- receives `token` query param
- verifies token with `/api/v1/user/me`
- saves token to system keychain
### Identity and logout
The README instructs users to execute npx skills add directly from a remote package source without pinning an exact version. Because npx resolves and runs the latest published package by default, a compromised or malicious upstream release could execute untrusted code in the user's environment during installation.
This command again relies on unpinned npx skills, causing users to fetch and execute whatever current package version is returned at runtime. In an agent-skill ecosystem where install commands are copied verbatim, this increases supply-chain risk and can lead to arbitrary code execution if the package or dependency chain is compromised.
The installation example invokes npx skills without constraining the package version, exposing users to remote code execution via malicious or tampered future releases. Since READMEs are often followed mechanically, this creates a realistic path for exploitation through package substitution or upstream compromise.
This command repeats the same unsafe pattern of executing an unpinned npx package. An attacker who gains control of the published package, its dependencies, or the resolution path could cause arbitrary code to run on developer or CI hosts.
By providing another unpinned npx skills example, the README normalizes execution of mutable remote code. In the context of installable agent skills, this is more dangerous because the audience is likely to grant broad filesystem or repository access during setup.
The trigger guidance includes broad phrases like general marketing automation tasks, which weakens activation boundaries for an auto-loading skill. Overly broad triggers can cause the skill to activate in unrelated contexts, increasing the chance that sensitive user data or commands are exposed to instructions not intended for the current task.
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- "Switch team context through Nudgen API and then fetch campaigns."
- "Read dashboard overview stats from a backend service."
Skill file: [skills/api/SKILL.md](./skills/api/SKILL.md)
### `cli`
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- "Switch to a team and list campaigns in JSON."
- "Show referral activity from terminal."
Skill file: [skills/cli/SKILL.md](./skills/cli/SKILL.md)
### `email-sending-best-practices`
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- "Should this message be campaign or transactional?"
- "How should we clean this stale audience before a comeback campaign?"
Skill file: [skills/email-sending-best-practices/SKILL.md](./skills/email-sending-best-practices/SKILL.md)
## Stability Notes
The contribution instructions tell maintainers to re-run npx skills add without pinning a version, which exposes contributor workstations to the same supply-chain execution risk. Because contributors may run this during development with repository write access, compromise could affect both local systems and the codebase.
The local validation step again uses unpinned npx skills, which can execute untrusted code from the current latest package. This is especially risky in a validation workflow, where users may assume the step is harmless and run it inside development environments containing credentials and source code.
The trigger scope explicitly includes broad phrases like general marketing automation tasks, which can cause the skill to activate outside narrowly intended Nudgen-specific contexts. Over-broad activation can lead to inappropriate tool selection, irrelevant guidance, or accidental exposure of powerful sub-skills such as API and CLI workflows when a more specific skill should have been used.
The skill instructs use of Personal Access Tokens and Bearer authentication but does not include explicit handling guidance such as never pasting real tokens into chats, logs, client-side code, or examples. In a coding-assistant context, omission of secret-safety warnings increases the chance that users expose live credentials during troubleshooting or copy insecure patterns into production.
The trigger list starts with specific examples but then expands to 'any request to integrate Nudgen in code instead of shell-only CLI usage,' which is broad and lacks clear boundaries. This can cause unintended invocation because it does not specify precise trigger phrases or negative examples beyond excluding shell-only CLI usage.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -sS \
-H "Authorization: Bearer $NUDGEN_PAT" \
https://app.nudgen.net/api/v1/user/me
This markdown file lists deletion commands such as nudgen teams delete <team-id> without any warning about destructive effects, confirmation requirements, or potential data loss. Under the markdown-file criteria, user-facing documentation should disclose behaviors that could affect user data or system integrity.
The reference includes nudgen brand delete <brand-id> but does not warn users that deleting a brand may remove or affect persisted data. In markdown documentation, destructive operations should be accompanied by clear warnings so users understand the risk before invoking them.