Ainative Platform Overview

• Outcome: Review
• Latest audit: Sep 15, 2026 · 12:41 AM UTC
• Version: 1.0.0

Overview

The skill is a coherent platform overview, but its setup guidance asks users to run unpinned and global package commands that can modify their development environment without enough scoping detail.

Before installing, verify the publisher and exact versions of the npm and Python packages, prefer pinned versions and project-local installs, review what `zerodb init` changes before running it, and avoid running these commands with administrator privileges.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:45

Finding

Unpinned Third-Party Package Installation and Execution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 45–75 and 81
Vulnerability Type: Unpinned package installation and mutable CLI execution
Risk Level: Medium

Evidence

bash

# React
npm install @ainative/react-sdk

# Next.js
npm install @ainative/next-sdk

# Svelte
npm install @ainative/svelte-sdk

# Vue
npm install @ainative/vue-sdk

bash

# Full ZeroDB MCP (76 tools — vectors, memory, NoSQL, files, PostgreSQL)
npm install -g ainative-zerodb-mcp-server

# Memory-only MCP (6 tools — lightweight)
npm install -g ainative-zerodb-memory-mcp

bash

# ZeroDB instant project setup (auto-configures your IDE)
npx zerodb init

bash

pip install zerodb-mcp
pip install zerodb-cli
pip install langchain-zerodb
pip install llama-index-vector-stores-zerodb

bash

# 1. Get an instant API key + project
npx zerodb init

Technical Analysis

The Skill instructs users to install npm and Python packages without fixed versions, lockfiles, integrity hashes, or other artifact verification. Consequently, the installed code depends on mutable package-registry state rather than the specific release reviewed by the Skill author.

The npx zerodb init command presents the greatest exposure because it can retrieve and immediately execute the currently resolved package version. npm packages may also execute package-controlled lifecycle scripts during installation. The global npm installation commands increase the affected environment's scope, while the comment stating that zerodb init automatically configures the user's IDE indicates that the CLI may modify local configuration.

The audited file does not provide verifiable provenance tying the referenced registry packages to the declared platform. This is a supply-chain weakness rather than evidence that the current packages are malicious.

Attack Path

1. An attacker compromises a referenced package publisher account, package release process, or another relevant part of the pac ...[truncated 1354 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin every npm and Python dependency to a reviewed, immutable version.
2. Replace the mutable CLI invocation with a pinned command, such as:

   bash

   npx zerodb@<reviewed-version> init
   

3. Provide and enforce lockfiles where the installation workflow supports them.
4. Use package integrity hashes or hash-locked Python requirements, and verify downloaded artifacts before execution.
5. Link to verified package-publisher profiles and document how users can validate package provenance.
6. Prefer local, project-scoped npm installation over global installation.
7. Avoid running package managers with administrator or root privileges.
8. Document all files, IDE settings, credentials, and network operations affected by zerodb init; request explicit user approval before modifying them.
9. Consider disabling installation scripts where compatible with the packages, or audit all lifecycle scripts before permitting execution.
10. Establish a release-review and dependency-monitoring process so pinned versions are updated only after security validation.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (5)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The skill instructs users to run npx zerodb init without pinning a specific package version. npx resolves the latest published package at execution time, which creates a supply-chain risk: a compromised maintainer account, typosquatted package, or malicious new release could execute arbitrary code on the user's machine. Because this is a setup command intended for immediate execution, the skill context makes the risk more practical than a passive reference.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

This quick-start step again asks the user to execute npx zerodb init without version pinning. Repeating the unpinned bootstrap command in a '30 seconds' getting-started workflow increases the likelihood of blind copy/paste execution, which amplifies supply-chain exposure if the package is ever hijacked or replaced with a malicious release.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 87)May include surrounding context.

md

npx zerodb init

# 2. Make your first API call
curl -X POST https://api.ainative.studio/v1/public/chat/completions \
  -H "X-API-Key: YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{"model": "claude-3-5-sonnet-20241022", "messages": [{"role": "user", "content": "Hello"}]}'

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 87)May include surrounding context.

md

npx zerodb init

# 2. Make your first API call
curl -X POST https://api.ainative.studio/v1/public/chat/completions \
  -H "X-API-Key: YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{"model": "claude-3-5-sonnet-20241022", "messages": [{"role": "user", "content": "Hello"}]}'

Rp1

Low

• Category: MCP Rug Pull
• Confidence: 87% confidence

Finding

The skill recommends pip install zerodb-mcp without constraining the version. This exposes users to dependency drift and Python package supply-chain risk, since future releases may introduce breaking changes or malicious code and will be installed by default when users follow the documentation. The risk is somewhat lower than npx one-shot execution, but still real for reproducible and secure environments.

Content

No source excerpt is available for this finding.