Validator Agent

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:49 PM UTC
• Version: 1.1.0

Overview

This skill is a project validator, but it can run broad shell commands and transient npm tools in user projects with limited scoping safeguards.

Review before installing. Use this only in trusted workspaces, prefer pinned local project tools, avoid automatic npx downloads, quote or validate project paths, and run validations in a sandbox without production secrets.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:30
• Finding: Unpinned npx Commands May Download and Execute Unreviewed Packages<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 30-56 **Vulnerability Type**: Unsafe dependency retrieval and execution **Risk Level**: Medium ### Vulnerable Code ```bash cd <project> && npx tsc --noEmit 2>&1 ``` ```bash cd <project> && npx type-coverage 2>&1 || echo "type-coverage not installed — skip" ``` ### Technical Analysis The validation instructions invoke `tsc` and `type-coverage` through `npx` without requiring an existing local installation, disabling automatic installation, or pinning the executable to a reviewed package version. Depending on the npm and `npx` version and configuration, `npx` may retrieve a package from the configured npm registry when the requested executable is unavailable locally. The downloaded package can execute installation lifecycle scripts or provide the command that is subsequently run. This means the effective code being executed may not have been present during the skill audit. The `npx tsc` command is also ambiguous because it requests an executable name rather than explicitly verifying that the executable belongs to a lockfile-pinned installation of the official `typescript` package. ### Attack Path 1. An attacker causes the validator to operate on a project that does not contain the expected local `tsc` or `type-coverage` executable. 2. The validator follows the documented command and invokes `npx`. 3. `npx` resolves the missing executable through the configured npm registry. 4. A malicious, compromised, confused, or otherwise unreviewed package is downloaded. 5. Package lifecycle scripts or the resolved executable run under the validator process's user account. 6. The downloaded code can access resources available to that account, including project files and locally exposed credentials. ### Impact Assessment Successful exploitation provides code execution with the operating-system privileges of the user or agent running the validator. The affected scope may include: - Reading, modif ...[truncated 509 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Require the relevant tools to be declared as lockfile-pinned development dependencies. 2. Disable implicit package installation: ```bash cd -- "$project" && npx --no-install tsc --noEmit cd -- "$project" && npx --no-install type-coverage ``` 3. Prefer invoking verified local executables directly: ```bash cd -- "$project" && ./node_modules/.bin/tsc --noEmit ``` 4. Before execution, verify that `typescript` and `type-coverage` are present in the project lockfile and installed from an approved registry. 5. Use reproducible installation controls such as `npm ci`, a committed lockfile, registry allowlisting, and integrity verification. 6. Fail safely when a required executable is absent rather than automatically retrieving it. 7. Run validation in a restricted container or sandbox without production credentials and with only necessary filesystem and network access. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:30
• Finding: Unquoted Project Path Permits Shell Command Injection<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 30-56 **Vulnerability Type**: Shell command injection through unsafe path interpolation **Risk Level**: Medium ### Vulnerable Code ```bash cd <project> && npx tsc --noEmit 2>&1 ``` ```bash cd <project> && npm run lint 2>&1 | tail -20 ``` ```bash cd <project> && npm test 2>&1 ``` ```bash cd <project> && npm audit 2>&1 | tail -15 ``` ```bash cd <project> && npx type-coverage 2>&1 || echo "type-coverage not installed — skip" ``` ### Technical Analysis The project path placeholder is embedded directly into shell command text without quoting, validation, or argument separation. If an implementation replaces `<project>` with user-controlled or repository-controlled text, shell metacharacters can alter the intended command structure. Characters and constructs such as semicolons, command substitutions, redirection operators, pipes, or logical operators may cause additional commands to execute. Unquoted paths containing spaces or wildcard characters can also be split or expanded unexpectedly, potentially validating the wrong location. The flaw arises from constructing a shell command by concatenating an untrusted path rather than treating the path as an opaque filesystem argument. ### Attack Path 1. An attacker supplies or influences the project argument used to invoke the validator. 2. The project value contains shell syntax, such as a command separator followed by an attacker-selected command. 3. The implementation substitutes that value directly into `cd <project> && ...`. 4. The shell parses the injected syntax as part of the command rather than as a directory name. 5. The injected command executes with the validator process's privileges. 6. The remaining validation command may then run, fail, or be suppressed depending on the injected shell expression. This path requires the implementation to interpolate the project value into the documented shell template without independent quotin ...[truncated 726 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Do not construct shell commands by interpolating the requested project value. 2. Resolve and validate the project path through a filesystem API before running any command. 3. Require the resolved path to be an existing directory under an explicitly approved workspace root. 4. Reject values containing null bytes and prevent traversal outside the approved root by checking the canonical path. 5. When shell use is unavoidable, quote the path and terminate option parsing: ```bash cd -- "$project" && npm test ``` 6. Prefer process-execution APIs that accept the executable, arguments, and working directory separately. For example, configure the validated project path as the process `cwd` rather than emitting a `cd` command. 7. Never use shell-enabled execution for untrusted path values unless strictly necessary. 8. Add tests covering paths with spaces, wildcard characters, command substitutions, separators, and traversal sequences. 9. Run validation with least privilege in an isolated environment to reduce the impact of any residual injection flaw. ]]>

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence
• Finding: Using `npx tsc` without pinning the package/version can cause the skill to fetch and execute whatever package version resolves at runtime if `typescript` is not already installed locally. In a validation skill that operators may run on arbitrary projects, this creates a supply-chain execution risk and reduces reproducibility of the security gate itself.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence
• Finding: Using `npx type-coverage` without an exact pinned version may download and execute a package from the registry at runtime, introducing a supply-chain risk. Because this skill is framed as a trusted validation pipeline, executing transient tooling undermines the integrity of the audit process and could allow malicious package substitution or unexpected behavior.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: The trigger list is broad and includes generic terms like "validate", "validator", and "quality check", which can cause the skill to be invoked in contexts the user did not specifically intend. Because this skill requests the powerful "exec" tool and is designed to run an automated multi-step pipeline, accidental invocation could lead to unexpected command execution or disruptive actions in unrelated workflows.

Static analysis

No suspicious patterns detected.