RPM Package Management

• Outcome: Pass
• Latest audit: Sep 14, 2026 · 11:53 PM UTC
• Version: 4.0.1

Overview

This is a coherent RPM packaging reference skill with some overconfident and potentially stale guidance, but no hidden code, persistence, credential access, or automatic execution.

Install only if you are comfortable using a Chinese RPM packaging guide. Treat it as a reference, not the sole authority: verify distro-specific rules, run builds in mock/containerized unprivileged environments, prefer deterministic dependency installs such as reviewed lockfiles, and avoid running install/remove package commands on your main system unless you intend that change.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:236

Finding

Unrestricted npm Dependency Installation During RPM Builds

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 70 and 236
Vulnerability Type: Unsafe third-party dependency installation and lifecycle-script execution
Risk Level: Medium

Vulnerable Code

At line 70, the build-system table recommends unrestricted dependency installation:

markdown

| Node.js | `%autosetup -p1 -n package` | `npm install` |手动安装|

At line 236, the Node.js RPM template executes the same operation during the build:

spec

### Node.js
```spec
BuildRequires: nodejs npm
%prep: %autosetup -p1 -n package
%build: npm install --production=false && npm run build
%install: mkdir -p %{buildroot}%{_datadir}/%{name} && cp -r . %{buildroot}%{_datadir}/%{name}/

text

### Technical Analysis

The recommended `%build` command invokes `npm install --production=false` without requiring:

- A reviewed and committed lockfile.
- Deterministic installation through `npm ci`.
- Disabled npm lifecycle scripts.
- An approved or pinned package registry.
- Dependency integrity or provenance verification.
- Isolation in a disposable, unprivileged build environment.

`npm install` can resolve mutable third-party dependency versions when dependency ranges are present. It can also execute lifecycle hooks such as `preinstall`, `install`, and `postinstall`. Those hooks execute with the permissions and environment of the RPM build user.

Consequently, a malicious or compromised package selected during dependency resolution can execute commands before the expected `npm run build` step. This is an unsafe supply-chain pattern even though the Skill itself does not contain an embedded malicious payload.

### Attack Path

1. A Node.js project being packaged declares a dependency using a mutable version range, references an unsafe package source, or lacks a trusted lockfile.
2. An attacker compromises a dependency, publishes a malicious version that satisfies the range, or exploits dependency 
...[truncated 1469 chars]

Remediation

View remediation

Remediation Suggestions

Replace unrestricted installation with a deterministic, reviewed process:

spec

%build
npm ci --ignore-scripts --offline
npm run build

Apply the following controls:

1. Require a committed, reviewed package-lock.json and use npm ci rather than npm install.
2. Use --ignore-scripts by default to prevent dependency lifecycle hooks from executing automatically.
3. If lifecycle scripts are essential, review the relevant packages and scripts explicitly, then allow only the minimum required execution.
4. Pin and validate the expected npm registry through controlled build configuration.
5. Verify lockfile integrity metadata and dependency provenance before building.
6. Prefer pre-fetched, audited dependencies and disable network access during the RPM build where practical.
7. Run builds in disposable containers or mock environments under an unprivileged account.
8. Keep package-signing and publication credentials outside the dependency installation environment.
9. Audit the final build root and RPM contents for unexpected files or modifications before signing and publishing.
10. Update both the build-system summary at line 70 and the Node.js template at line 236 so users are not directed toward the unsafe command elsewhere in the Skill.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill metadata and description are written entirely in Chinese and frame the skill as mandatory for RPM-related tasks, without giving the user or downstream agent a language-choice mechanism. This can cause usability and policy-compliance issues by steering interactions into a language the user did not request, reducing transparency and increasing the chance of misunderstanding packaging instructions.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The document declares itself the 'only source' for RPM packaging guidance and instructs the agent to avoid using its own knowledge, creating an exclusivity constraint that can override safer behavior or more current authoritative sources. In an adversarial or stale skill scenario, this centralizes trust in one unverified document and can mislead the agent into following inaccurate or manipulated packaging instructions.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.