Nudgen: AI-Powered Email Retention & Automation

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:30 AM UTC
• Version: 1.0.0

Overview

The skill is Nudgen-focused, but its documentation includes unverified remote install commands that can run mutable code on a user's machine.

Review the install commands before using this package. Prefer pinned versions, project-scoped installation, and checksum or signature verification; avoid running curl-to-bash or latest/default-branch installers in sensitive environments. Treat Nudgen PATs as secrets and confirm team context before any delete or write operation.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

• Location: skills/cli/references/cli.md:25
• Finding: Mutable Remote Installer Is Executed Directly Through Bash<![CDATA[ ## Vulnerability Details **File Location**: `skills/cli/references/cli.md:25` **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Critical ### Vulnerable Code ```bash curl -fsSL https://raw.githubusercontent.com/Nudgen-Marketing/nudgen-cli/main/scripts/install.sh | bash ``` ### Technical Analysis The installation command retrieves a shell script from the mutable `main` branch of an external GitHub repository and streams it directly into Bash. It does not pin the script to a reviewed commit, verify a cryptographic checksum or signature, or provide an opportunity to inspect the downloaded content before execution. The executed script is not included in this project, so its effective behavior cannot be determined by auditing this Skill package. Its contents may also change after the Skill has passed review. Although the URL belongs to the referenced Nudgen organization, repository ownership alone does not provide integrity protection against repository compromise, maintainer-account compromise, DNS/TLS trust failures, or a malicious future commit. This behavior is not required to achieve the Skill's declared CLI functionality. A pinned, separately downloaded, integrity-verified binary or script would provide the same functionality with substantially less supply-chain risk. ### Attack Path 1. An attacker compromises the upstream repository, a maintainer account, or the installation script on the mutable `main` branch. 2. The attacker modifies `scripts/install.sh` to include malicious shell commands. 3. A user or AI agent follows the Skill's documented installation command. 4. `curl` downloads the modified script and streams it directly to Bash. 5. Bash executes the attacker-controlled commands without local review or integrity verification. ### Impact Assessment The remote script receives arbitrary code execution with all privileges of the account running the command. It could read or modify user-accessible files, ste ...[truncated 490 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the pipe-to-shell installation command. 2. Publish versioned releases and pin installation instructions to a specific reviewed release or immutable commit. 3. Download the artifact as a separate step rather than executing streamed network content. 4. Publish SHA-256 checksums or cryptographic signatures through an independently protected release process. 5. Require checksum or signature verification before execution or installation. 6. Prefer a package manager or signed release artifact that provides provenance and integrity validation. 7. Run installation with ordinary user privileges and avoid requesting `sudo` unless a specific destination requires it. 8. If a script must be used, instruct users to save and inspect it first: ```bash curl -fL -o install.sh "https://raw.githubusercontent.com/Nudgen-Marketing/nudgen-cli/<reviewed-commit>/scripts/install.sh" printf '%s %s\n' "<published-sha256>" "install.sh" | sha256sum --check - less install.sh bash install.sh ``` The commit and checksum must be replaced with immutable, publisher-verified values. ]]>

T08 · Insecure Dependencies

Warning

• Location: README.md:17
• Finding: Unpinned npx-Based Skill Installation Creates Supply-Chain Exposure<![CDATA[ ## Vulnerability Details **File Location**: `README.md:17-25` **Vulnerability Type**: Insecure dependencies and mutable installation sources **Risk Level**: Medium ### Vulnerable Code ```bash # See available skills in this package npx skills add https://github.com/Nudgen-Marketing/skills --list # Install all Nudgen skills globally npx skills add https://github.com/Nudgen-Marketing/skills --global # Install specific skills globally npx skills add https://github.com/Nudgen-Marketing/skills --global --skill api npx skills add https://github.com/Nudgen-Marketing/skills --global --skill cli npx skills add https://github.com/Nudgen-Marketing/skills --global --skill email-sending-best-practices ``` ### Technical Analysis The commands invoke `npx skills` without pinning the npm package to a reviewed version. Depending on the local environment, `npx` may retrieve and execute package code from the npm registry. The GitHub repository argument is also not pinned to an immutable commit or release. Consequently, the code and Skill instructions installed by these commands may differ from the versions that were audited. The use of `--global` broadens the installation scope beyond the current project and can cause altered Skill instructions to affect unrelated projects or future agent sessions. The audit did not establish that the current npm package or GitHub repository is malicious. The vulnerability is the absence of version and integrity controls, which leaves installation security dependent on mutable third-party state. ### Attack Path 1. An attacker compromises the relevant npm package, its maintainer account, or the referenced GitHub repository. 2. The attacker publishes or commits a modified package or Skill definition. 3. A user runs an unpinned `npx skills add` command from the README. 4. `npx` resolves and executes the currently available package, which then retrieves mutable repository content. 5. With `--global`, the altered Skills are installe ...[truncated 632 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin the `skills` npm package to a reviewed exact version rather than invoking an unversioned package name. 2. Pin the GitHub source to an immutable commit hash or signed release tag. 3. Use lockfile-backed package installation where supported. 4. Verify package provenance, checksums, and signatures before execution. 5. Prefer project-scoped installation by default; document `--global` only as an explicit opt-in with a warning about its broader effect. 6. Review the files that will be installed before enabling them in a persistent or global agent environment. 7. Automate dependency monitoring and re-audit each new pinned version before updating the documentation. ]]>

T08 · Insecure Dependencies

Warning

• Location: skills/cli/references/cli.md:28
• Finding: Unpinned Go and Source-Build Installation Executes Mutable Upstream Content<![CDATA[ ## Vulnerability Details **File Location**: `skills/cli/references/cli.md:28-39` **Vulnerability Type**: Insecure dependency installation **Risk Level**: Medium ### Vulnerable Code ```bash ### Go install ```bash go install github.com/Nudgen-Marketing/nudgen-cli@latest ``` ### Local build ```bash git clone https://github.com/Nudgen-Marketing/nudgen-cli.git cd nudgen-cli make install build ``` ``` ### Technical Analysis The Go installation uses `@latest`, and the source-build method clones the repository's current default branch. Neither method identifies an immutable reviewed version. The subsequent `make install build` command executes upstream Makefile rules and build tooling that are absent from this project and therefore could not be evaluated during this audit. If the upstream repository or release process changes after review, users may compile or install code different from what was audited. Building from source does not mitigate supply-chain risk when the source itself is mutable and its build instructions are executed without inspection. The local-build option is operationally relevant to the CLI, but pinning and integrity verification are necessary. Executing mutable upstream build logic is not the minimum-risk method of providing the declared functionality. ### Attack Path 1. An attacker compromises the upstream repository, release process, or maintainer credentials. 2. The attacker modifies Go source code, build hooks, dependencies, or Makefile targets. 3. A user runs either `go install ...@latest` or clones the current default branch. 4. Go tooling or `make install build` processes the attacker-controlled upstream content. 5. Malicious build-time commands execute, or a modified CLI binary is installed and later receives Nudgen credentials. ### Impact Assessment Malicious Makefile rules or build tooling could execute arbitrary commands with the invoking user's privileges. A trojanized CLI could access the Nudgen token stored t ...[truncated 468 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace `@latest` with a specific reviewed semantic version. 2. Clone a signed release tag or immutable commit instead of the default branch. 3. Publish and verify checksums or signatures for release binaries and source archives. 4. Inspect the Makefile and build hooks before running any target. 5. Separate build and installation steps so users can inspect the resulting artifact before placing it on `PATH`. 6. Avoid privileged installation destinations and install into a user-controlled directory where possible. 7. Pin transitive Go dependencies through a reviewed `go.mod` and verify module checksums. 8. Prefer signed, reproducible release binaries when available, and document how users can validate their provenance. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (28)

Credential Access

High

• Category: Privilege Escalation

Content

description: >
  Use this skill whenever the user wants to integrate Nudgen from application
  code, backend services, webhooks, or server-side automation. This includes
  Nudgen API authentication with Personal Access Tokens (PATs), contacts,
  campaigns, stats, teams, brand configs, and affiliate/referral endpoints.
  Trigger on phrases like "Nudgen API", "send request to /api/v1", "Bearer
  PAT", "create contact in backend", "switch team via API", or any request to

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

## Authentication

Every request uses a Personal Access Token (PAT):

```http
Authorization: Bearer <PAT>

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

- `GET /contacts`
  - `POST /contacts/add`
  - `PATCH /contacts/:id`
  - `DELETE /contacts/:id`
- Campaigns
  - `GET /campaigns`
  - `POST /campaigns`

• Confidence: 80% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

- Campaigns
  - `GET /campaigns`
  - `POST /campaigns`
  - `DELETE /campaigns/:id`
- Stats
  - `GET /dashboard/overview`
- Teams

• Confidence: 80% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

- `GET /teams`
  - `POST /teams`
  - `POST /teams/switch`
  - `DELETE /teams/:id`
- Brand config
  - `GET /brand`
  - `POST /brand`

• Confidence: 80% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

- `GET /brand`
  - `POST /brand`
  - `PATCH /brand/:id`
  - `DELETE /brand/:id`
- Affiliate/referral
  - `GET /affiliate/me`
  - `GET /affiliate/analytics`

• Confidence: 80% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Chaining Abuse

High

• Category: Tool Misuse

Content

### Install script

```bash
curl -fsSL https://raw.githubusercontent.com/Nudgen-Marketing/nudgen-cli/main/scripts/install.sh | bash
```

### Go install

• Confidence: 98% confidence
• Finding: The `| bash` construct turns a network fetch into immediate shell execution, enabling command chaining abuse and making any compromise of the upstream content equivalent to arbitrary code execution on the user's machine. Because this is in a CLI reference skill, the likelihood of copy-paste execution is elevated, which makes the guidance materially more dangerous.

Credential Access

High

• Category: Privilege Escalation

Content

- starts local callback receiver on port `3456`
- receives `token` query param
- verifies token with `/api/v1/user/me`
- saves token to system keychain

### Identity and logout

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 89% confidence
• Finding: The README instructs users to execute `npx skills add` directly from a remote package source without pinning an exact version. Because `npx` resolves and runs the latest published package by default, a compromised or malicious upstream release could execute untrusted code in the user's environment during installation.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 89% confidence
• Finding: This command again relies on unpinned `npx skills`, causing users to fetch and execute whatever current package version is returned at runtime. In an agent-skill ecosystem where install commands are copied verbatim, this increases supply-chain risk and can lead to arbitrary code execution if the package or dependency chain is compromised.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 89% confidence
• Finding: The installation example invokes `npx skills` without constraining the package version, exposing users to remote code execution via malicious or tampered future releases. Since READMEs are often followed mechanically, this creates a realistic path for exploitation through package substitution or upstream compromise.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 89% confidence
• Finding: This command repeats the same unsafe pattern of executing an unpinned `npx` package. An attacker who gains control of the published package, its dependencies, or the resolution path could cause arbitrary code to run on developer or CI hosts.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 89% confidence
• Finding: By providing another unpinned `npx skills` example, the README normalizes execution of mutable remote code. In the context of installable agent skills, this is more dangerous because the audience is likely to grant broad filesystem or repository access during setup.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The trigger guidance includes broad phrases like general marketing automation tasks, which weakens activation boundaries for an auto-loading skill. Overly broad triggers can cause the skill to activate in unrelated contexts, increasing the chance that sensitive user data or commands are exposed to instructions not intended for the current task.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

- "Switch team context through Nudgen API and then fetch campaigns."
- "Read dashboard overview stats from a backend service."

Skill file: [skills/api/SKILL.md](./skills/api/SKILL.md)

### `cli`

• Confidence: 80% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

- "Switch to a team and list campaigns in JSON."
- "Show referral activity from terminal."

Skill file: [skills/cli/SKILL.md](./skills/cli/SKILL.md)

### `email-sending-best-practices`

• Confidence: 80% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

- "Should this message be campaign or transactional?"
- "How should we clean this stale audience before a comeback campaign?"

Skill file: [skills/email-sending-best-practices/SKILL.md](./skills/email-sending-best-practices/SKILL.md)

## Stability Notes

• Confidence: 80% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 86% confidence
• Finding: The contribution instructions tell maintainers to re-run `npx skills add` without pinning a version, which exposes contributor workstations to the same supply-chain execution risk. Because contributors may run this during development with repository write access, compromise could affect both local systems and the codebase.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 86% confidence
• Finding: The local validation step again uses unpinned `npx skills`, which can execute untrusted code from the current latest package. This is especially risky in a validation workflow, where users may assume the step is harmless and run it inside development environments containing credentials and source code.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The trigger scope explicitly includes broad phrases like general marketing automation tasks, which can cause the skill to activate outside narrowly intended Nudgen-specific contexts. Over-broad activation can lead to inappropriate tool selection, irrelevant guidance, or accidental exposure of powerful sub-skills such as API and CLI workflows when a more specific skill should have been used.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill instructs use of Personal Access Tokens and Bearer authentication but does not include explicit handling guidance such as never pasting real tokens into chats, logs, client-side code, or examples. In a coding-assistant context, omission of secret-safety warnings increases the chance that users expose live credentials during troubleshooting or copy insecure patterns into production.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The trigger list starts with specific examples but then expands to 'any request to integrate Nudgen in code instead of shell-only CLI usage,' which is broad and lacks clear boundaries. This can cause unintended invocation because it does not specify precise trigger phrases or negative examples beyond excluding shell-only CLI usage.

External Transmission

Medium

• Category: Data Exfiltration

Content

### Identity check

```bash
curl -sS \
  -H "Authorization: Bearer $NUDGEN_PAT" \
  https://app.nudgen.net/api/v1/user/me
```

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: This markdown file lists deletion commands such as `nudgen teams delete <team-id>` without any warning about destructive effects, confirmation requirements, or potential data loss. Under the markdown-file criteria, user-facing documentation should disclose behaviors that could affect user data or system integrity.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The reference includes `nudgen brand delete <brand-id>` but does not warn users that deleting a brand may remove or affect persisted data. In markdown documentation, destructive operations should be accompanied by clear warnings so users understand the risk before invoking them.

Static analysis

No suspicious patterns detected.