Skills

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:57 AM UTC
• Version: 1.0.0

Overview

The skill is purpose-aligned, but it recommends and ships CI/build commands that execute mutable third-party npm and GitHub Action code without pinning.

Review before installing or using in CI. Prefer pinning pageskim to a reviewed exact version or adding it as a locked project dependency, and pin the GitHub Action to a full commit SHA with minimal workflow permissions and limited secrets exposure.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: scripts/generate-and-validate.sh:14

Finding

Unpinned npm Package Is Automatically Downloaded and Executed

Content

View full analysis

Vulnerability Details

File Location: scripts/generate-and-validate.sh, lines 14–20
Vulnerability Type: Unpinned third-party executable dependency
Risk Level: Medium

bash

npx --yes pageskim "${ARGS[@]}"

STATUS=0
while IFS= read -r -d '' page; do
  sibling="${page%.*}.llm.md"
  if [[ -f "$sibling" ]]; then
    if ! npx --yes pageskim validate "$page" "$sibling"; then

The same unpinned npx pageskim execution pattern is also recommended in SKILL.md at lines 18–19, 41, 57, 65, 85, and 87.

Technical Analysis

The script invokes pageskim through npx --yes without specifying an exact package version, committed lockfile, or integrity constraint. If the package is not already available locally, npx may download the currently resolved release from the configured npm registry. The --yes option automatically approves installation.

Consequently, the code executed during a future Skill invocation is not limited to the version reviewed during this audit. A compromised npm package, maintainer account, registry response, or malicious future release could introduce arbitrary lifecycle or CLI code.

Attack Path

1. An attacker compromises the pageskim package, its publisher account, or its distribution path.
2. The attacker publishes a malicious version that still resolves under the unversioned package name.
3. A user or CI runner invokes scripts/generate-and-validate.sh.
4. npx --yes pageskim retrieves and executes the malicious package without an interactive approval step.
5. The payload executes with the permissions and environment of the invoking user or CI runner.
6. The payload can access data available to that process, potentially including repository files, build artifacts, environment variables, and CI credentials.

Impact Assessment

Successful exploitation permits arbitrary code execution within the invoking process's security context. On a developer workstation, th ...[truncated 344 chars]

Remediation

View remediation

Remediation Suggestions

• Pin pageskim to a reviewed, exact version rather than resolving the latest compatible release.
• Declare the dependency in package.json and commit the generated lockfile.
• Install dependencies using npm ci, then invoke the lockfile-controlled local executable, for example through an npm script or npx --no-install pageskim.
• Review package lifecycle scripts before approving dependency updates.
• Enable npm provenance, integrity, and registry-policy checks where supported.
• Use automated dependency updates only when each update is reviewed and tested before merging.
• Avoid --yes for ad hoc remote package execution where interactive confirmation is practical.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:76

Finding

GitHub Action Is Referenced Through a Mutable Branch

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 76–79
Vulnerability Type: Mutable CI dependency reference
Risk Level: Medium

yaml

- run: npm run build
- uses: venki0552/PageSkim/.github/action@main
  with:
    path: <output-dir>
    base-url: <site-url>

Technical Analysis

The recommended workflow references the external GitHub Action using @main. A branch is mutable, so the action code fetched by consumers can change after this Skill and the referenced action have been reviewed. Consumers following this guidance therefore execute upstream code whose effective contents are not cryptographically fixed by the workflow.

GitHub Actions generally execute with access to the checked-out repository and the workflow's granted token permissions. Depending on workflow configuration and event type, they may also receive secrets or deployment credentials.

Attack Path

1. An attacker compromises the upstream repository, a maintainer account, or the process controlling the main branch.
2. The attacker modifies the composite action or another file used by that action.
3. A consumer runs a workflow containing uses: venki0552/PageSkim/.github/action@main.
4. GitHub resolves main to the attacker-controlled revision.
5. The modified action executes within the consumer's CI job.
6. The payload can inspect or modify the workspace and access credentials available to that job.

Impact Assessment

Successful exploitation can provide arbitrary code execution within the GitHub Actions runner. The accessible scope may include source code, build artifacts, the job's GITHUB_TOKEN, explicitly supplied secrets, deployment credentials, caches, and reachable services. Actual privileges depend on repository workflow permissions, secret exposure rules, event type, and runner configuration. Self-hosted runners may increase the potential impact if they expose persistent files or internal ne ...[truncated 13 chars]

Remediation

View remediation

Remediation Suggestions

• Replace the mutable @main reference with a reviewed full 40-character commit SHA.
• Retain a version comment beside the SHA for maintainability, while keeping the executable reference immutable.
• Configure dependency automation to propose SHA updates through pull requests.
• Review action changes before accepting each updated SHA.
• Restrict GITHUB_TOKEN permissions to the minimum required by the job.
• Do not expose unrelated secrets to the action, and isolate deployment operations into separately protected jobs.
• Prefer ephemeral hosted runners or appropriately isolated self-hosted runners.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (10)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The skill instructs the agent to execute npx pageskim without pinning an exact package version or integrity-verified source. npx will fetch and run the latest published package at execution time, creating a supply-chain execution path where a compromised publisher account, malicious new release, or dependency hijack can lead to arbitrary code execution on the user's machine or CI runner.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 88% confidence

Finding

The recommendation to run npx astro build without an exact version can cause the environment to download and execute whatever version npm currently resolves, rather than a reviewed, deterministic one. While Astro is a common build tool and may often already be present in the project, this guidance still permits unintended code execution and non-reproducible builds if fetched remotely.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 88% confidence

Finding

The skill suggests npx next build without pinning the Next.js version, which can trigger remote package retrieval and execution of an unreviewed version. In CI or local developer environments, this weakens supply-chain safety and makes the build behavior non-deterministic.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

This command runs npx pageskim generate ... against site output without pinning the package version, so execution depends on the current npm registry state at runtime. Because the skill is intended to modify build pipelines and process publishable artifacts, a compromised package could execute arbitrary code during build or deployment and tamper with outputs.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

npx --yes pageskim generate ... is especially risky because it suppresses the install confirmation and immediately downloads and executes the package if absent, with no version pinning. In deployment scripts this can provide a direct, unattended supply-chain execution path on developer machines or CI runners.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The CI validation flow includes npx pageskim generate ... without version pinning, exposing automated runners to registry-supplied code at execution time. Because CI often has repository write tokens, secrets, or deployment credentials, compromise of the fetched package could have outsized impact.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The loop uses npx pageskim validate for each page without pinning a version, so every CI or local run depends on the latest registry-resolved code. In the context of validation jobs, this creates a repeatable supply-chain risk that can execute arbitrary code and potentially exfiltrate secrets or alter build status.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence

Finding

The verification guidance tells the user to run npx pageskim validate without locking the version, again allowing remote execution of whichever package version npm resolves at that moment. Even though this is framed as a manual verification step, it still exposes the operator to the same supply-chain compromise class.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The script executes npx --yes pageskim without pinning an exact package version, so every run may fetch and execute whatever version is currently published under that name. In a CI or build environment this creates a supply-chain execution path where a compromised upstream release, typo-squatted package, or unexpected breaking change can run arbitrary code during site generation.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

This second npx --yes pageskim validate invocation has the same unpinned remote-package execution risk as the generate step. Because validation is likely to run automatically in CI, an attacker who can influence the published package could obtain code execution in a trusted pipeline and potentially access repository contents, secrets, or deployment credentials.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.