Security audit

Validator Agent

Security checks for vulnerabilities and agentic risk

Overview

This skill is a project validator, but it can run broad shell commands and transient npm tools in user projects with limited scoping safeguards.

Review before installing. Use this only in trusted workspaces, prefer pinned local project tools, avoid automatic npx downloads, quote or validate project paths, and run validations in a sandbox without production secrets.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:30
Finding: Unpinned npx Commands May Download and Execute Unreviewed Packages
Content: View full analysis
&& npx tsc --noEmit 2>&1 ``` ```bash cd && npx type-coverage 2>&1 || echo "type-coverage not installed — skip" ``` ### Technical Analysis The validation instructions invoke `tsc` and `type-coverage` through `npx` without requiring an existing local installation, disabling automatic installation, or pinning the executable to a reviewed package version. Depending on the npm and `npx` version and configuration, `npx` may retrieve a package from the configured npm registry when the requested executable is unavailable locally. The downloaded package can execute installation lifecycle scripts or provide the command that is subsequently run. This means the effective code being executed may not have been present during the skill audit. The `npx tsc` command is also ambiguous because it requests an executable name rather than explicitly verifying that the executable belongs to a lockfile-pinned installation of the official `typescript` package. ### Attack Path 1. An attacker causes the validator to operate on a project that does not contain the expected local `tsc` or `type-coverage` executable. 2. The validator follows the documented command and invokes `npx`. 3. `npx` resolves the missing executable through the configured npm registry. 4. A malicious, compromised, confused, or otherwise unreviewed package is downloaded. 5. Package lifecycle scripts or the resolved executable run under the validator process's user account. 6. The downloaded code can access resources available to that account, including project files and locally exposed credentials. ### Impact Assessment Successful exploitation provides code execution with the operating-system privileges of the user or agent running the validator. The affected scope may include: - Reading, modif ...[truncated 509 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:30
Finding: Unquoted Project Path Permits Shell Command Injection
Content: View full analysis
&& npx tsc --noEmit 2>&1 ``` ```bash cd && npm run lint 2>&1 | tail -20 ``` ```bash cd && npm test 2>&1 ``` ```bash cd && npm audit 2>&1 | tail -15 ``` ```bash cd && npx type-coverage 2>&1 || echo "type-coverage not installed — skip" ``` ### Technical Analysis The project path placeholder is embedded directly into shell command text without quoting, validation, or argument separation. If an implementation replaces `` with user-controlled or repository-controlled text, shell metacharacters can alter the intended command structure. Characters and constructs such as semicolons, command substitutions, redirection operators, pipes, or logical operators may cause additional commands to execute. Unquoted paths containing spaces or wildcard characters can also be split or expanded unexpectedly, potentially validating the wrong location. The flaw arises from constructing a shell command by concatenating an untrusted path rather than treating the path as an opaque filesystem argument. ### Attack Path 1. An attacker supplies or influences the project argument used to invoke the validator. 2. The project value contains shell syntax, such as a command separator followed by an attacker-selected command. 3. The implementation substitutes that value directly into `cd && ...`. 4. The shell parses the injected syntax as part of the command rather than as a directory name. 5. The injected command executes with the validator process's privileges. 6. The remaining validation command may then run, fail, or be suppressed depending on the injected shell expression. This path requires the implementation to interpolate the project value into the documented shell template without independent quotin ...[truncated 726 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Rp1

Medium

Category: MCP Rug Pull
Confidence: 96% confidence
Finding: Using npx tsc without pinning the package/version can cause the skill to fetch and execute whatever package version resolves at runtime if typescript is not already installed locally. In a validation skill that operators may run on arbitrary projects, this creates a supply-chain execution risk and reduces reproducibility of the security gate itself.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 97% confidence
Finding: Using npx type-coverage without an exact pinned version may download and execute a package from the registry at runtime, introducing a supply-chain risk. Because this skill is framed as a trusted validation pipeline, executing transient tooling undermines the integrity of the audit process and could allow malicious package substitution or unexpected behavior.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The trigger list is broad and includes generic terms like "validate", "validator", and "quality check", which can cause the skill to be invoked in contexts the user did not specifically intend. Because this skill requests the powerful "exec" tool and is designed to run an automated multi-step pipeline, accidental invocation could lead to unexpected command execution or disruptive actions in unrelated workflows.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.