Security audit

Dependency Guard

Security checks for vulnerabilities and agentic risk

Overview

The skill has a legitimate dependency-review purpose, but its helper script and CI example include avoidable file-handling and credentialed execution risks that users should review before installing.

Install only if you are comfortable with Socket-based external dependency lookups. Prefer MCP depscore or a pinned, reviewed Socket CLI version. Do not copy the CI example without pinning the CLI/actions and trimming GitHub token permissions, and avoid using the helper's --output option with arbitrary or sensitive paths.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: examples/github/dependency-guard.yml:32
Finding: Unpinned Third-Party CLI Is Executed with CI Credentials
Content: View full analysis
Remediation: View remediation
``` 2. Prefer a lockfile-backed local development dependency and execute it with a lockfile-enforcing installation process such as `npm ci`. 3. Pin `actions/checkout` and `actions/setup-node` to reviewed immutable commit SHAs. 4. Confirm whether `socket ci` requires both `pull-requests: write` and `issues: write`; remove every permission not strictly required. 5. Keep credentials scoped to only the execution step that needs them, as the workflow currently does, and avoid exposing them to installation steps. 6. Use a narrowly scoped Socket integration key and rotate it after any suspected upstream compromise. 7. Apply GitHub environment protections or other approval controls where practical. 8. Monitor and review dependency updates before changing the pinned CLI version. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/check_dependency.sh:48
Finding: Arbitrary Output Path Allows Writable-File Overwrite or Deletion
Content: View full analysis
"$output"; then rm -f "$output" echo "Socket package lookup failed. Authenticate with \`socket login\` or set SOCKET_SECURITY_API_TOKEN. If your Socket CLI supports blank-submit login, that may enable limited public access." >&2 exit 70 fi ``` ### Technical Analysis The `--output` argument accepts an arbitrary path and uses it directly as a shell redirection target. Shell quoting prevents command injection through the path, but it does not prevent filesystem manipulation. The `>"$output"` redirection opens and truncates an existing target before the Socket command executes. If the command fails, `rm -f "$output"` then removes the selected path. No validation confines output to the intended `tmp/socket-reports` directory, and there are no checks for symbolic links, existing sensitive files, or non-regular files. The script therefore violates least-safe file handling when its arguments can be influenced by an untrusted caller. The effective scope is limited to files writable by the user running the script. ### Attack Path 1. An attacker or untrusted automation controls or influences arguments passed to `check_dependency.sh`. 2. The attacker supplies `--output` with the path of a writable source file, configuration file, credential file, or symbolic link to such a file. 3. `mkdir -p "$(dirname "$output")"` accepts the selected parent path. 4. Shell redirection opens and truncates the target before `socket package` starts. 5. If the Socket command succeeds, its Markdown output replaces the original content. 6. If the Socket command fails, the cleanup branch execu ...[truncated 640 chars]
Remediation: View remediation
"$tmp_output"; then echo "Socket package lookup failed." >&2 exit 70 fi validated_output="$report_dir/.md" mv -- "$tmp_output" "$validated_output" trap - EXIT ``` ]]>

SkillSpector

Vulnerability Patterns

MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 61)May include surrounding context.
md
- Keep `SKILL.md` lean; do not duplicate the full policy here.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill explicitly instructs the agent to use network-capable tooling (socket CLI or MCP depscore) but does not declare any tool scope such as permissions or allowed-tools. That creates a least-privilege gap: a host may permit broader tool or network access than intended, and users/reviewers cannot clearly see or constrain the skill’s external communication requirements.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.