Skill

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:51 AM UTC
• Version: 1.0.0

Overview

The skill appears purpose-aligned for local git-history search, but it installs and can run a mutable unpinned npm package with broad access to the user's repository history.

Review and pin the slg-cli npm version before installing, prefer a project-local or sandboxed install over a global install, and avoid indexing repositories whose git history may contain sensitive material unless you are comfortable with a local semantic index being created.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:13

Finding

Unpinned Third-Party npm Package Installation and Execution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 13–17 and 27–29
Vulnerability Type: Unpinned third-party dependency installation and execution
Risk Level: Medium

Vulnerable code:

yaml

install:
  - id: npm-global
    kind: node
    package: slg-cli
    bins: [slg]
    label: "Install slg-cli (npm global)"

bash

npm install -g slg-cli
# or run without installing
npx slg-cli <command>

Technical Analysis

The skill instructs users or agents to install or directly execute slg-cli without specifying an exact version or verifying the package's integrity. Both commands resolve a mutable package version from the npm registry. The global installation can also run npm lifecycle scripts and place an executable in the user's global binary path. The npx alternative may download and immediately execute the latest matching registry artifact.

Consequently, the code ultimately executed is not fixed to the artifact reviewed in this audit. If the npm publisher account, package, release process, or transitive dependency chain is compromised, a malicious package version could execute arbitrary code under the invoking user's account. The GitHub homepage declared in the metadata does not establish that a downloaded npm artifact corresponds to reviewed source code.

Attack Path

1. An attacker compromises the slg-cli npm package, its publisher account, release pipeline, or a dependency included in a future release.
2. The attacker publishes a malicious version under the same package name.
3. A user or agent follows SKILL.md and runs npm install -g slg-cli or npx slg-cli <command>.
4. npm resolves the mutable malicious release and may execute its lifecycle scripts during installation.
5. The installed or downloaded CLI executes with the privileges of the invoking user.
6. Malicious code can access resources available to that user, including the current repository, G ...[truncated 599 chars]

Remediation

View remediation

Remediation Suggestions

• Pin slg-cli to a specific, audited version in both metadata and command examples, such as slg-cli@X.Y.Z.
• Verify the package using a trusted integrity digest, signed provenance, or an audited lockfile before execution.
• Avoid global installation where possible; install the dependency in an isolated project directory or disposable sandbox with minimal filesystem and network permissions.
• Avoid unrestricted npx execution of an unversioned package. Use an exact version and configure npm not to accept an unexpected package resolution.
• Disable npm lifecycle scripts during installation with --ignore-scripts where the package can operate without them.
• Document the expected npm registry, publisher identity, release provenance, and checksums so consumers can validate the artifact.
• Review and pin transitive dependencies, and use automated dependency and provenance monitoring for future releases.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 89% confidence

Finding

The skill recommends running npx slg-cli without pinning an exact package version, which can cause users or agents to fetch and execute whatever version is current on the npm registry at runtime. If the package is compromised, typo-squatted, or a malicious update is published, this becomes a supply-chain execution risk directly in the user's environment.

Content

No source excerpt is available for this finding.