Tob Sales Proposal

• Outcome: Pass
• Latest audit: Jul 9, 2026 · 11:01 PM UTC
• Version: 1.2.2

Overview

This is a local proposal-generation CLI that writes user-directed HTML output and does not show hidden data access, network calls, credential use, persistence, or destructive behavior.

Reasonable to install if you need a local sales-proposal HTML generator. Review generated proposals before sending externally, especially the bundled case claims and ROI numbers, and prefer lockfile-based installs to avoid dependency drift.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The HTML contains a hard-coded customer case and fixed proposal narrative while the skill claims output is based on a knowledge base of real cases. This creates a trust and integrity issue: users may believe the case evidence is retrieved, current, and customer-relevant when it is actually static marketing content, leading to misleading business decisions or misrepresentation to downstream recipients.

Description-Behavior Mismatch

Medium

• Confidence: 98% confidence
• Finding: The skill description promises generation from user-supplied customer information, industry, pain points, and product, but the file is a fixed retail/intelligent-customer-service proposal template. In an agent skill context, this mismatch can cause silent misuse: operators may rely on the tool for customized external-facing sales materials when it cannot actually adapt content, causing deception, data quality failures, and operational risk.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"author": "ToB Skills Team",
  "license": "MIT",
  "dependencies": {
    "commander": "^11.0.0",
    "inquirer": "^8.2.6",
    "chalk": "^4.1.2",
    "handlebars": "^4.7.8",

• Confidence: 88% confidence
• Finding: Using a caret range for commander allows future compatible releases to be installed automatically, which can introduce unreviewed code or supply-chain regressions. In an agent skill, dependency drift is more risky because generated outputs and CLI behavior may change unexpectedly across installs.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"license": "MIT",
  "dependencies": {
    "commander": "^11.0.0",
    "inquirer": "^8.2.6",
    "chalk": "^4.1.2",
    "handlebars": "^4.7.8",
    "fs-extra": "^11.1.0"

• Confidence: 88% confidence
• Finding: Using a caret range for inquirer permits automatic uptake of later releases within the major version, increasing supply-chain risk and reducing reproducibility. For an interactive CLI skill, unexpected dependency changes can affect prompt handling and trust boundaries.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"dependencies": {
    "commander": "^11.0.0",
    "inquirer": "^8.2.6",
    "chalk": "^4.1.2",
    "handlebars": "^4.7.8",
    "fs-extra": "^11.1.0"
  },

• Confidence: 88% confidence
• Finding: An unpinned chalk dependency permits dependency drift and potential exposure to compromised or breaking upstream releases. While not an immediate exploit on its own, it weakens build integrity and reproducibility.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"commander": "^11.0.0",
    "inquirer": "^8.2.6",
    "chalk": "^4.1.2",
    "handlebars": "^4.7.8",
    "fs-extra": "^11.1.0"
  },
  "engines": {

• Confidence: 95% confidence
• Finding: The handlebars dependency is not only unpinned but also already flagged as known-vulnerable, making version drift especially dangerous. In a proposal-generation skill that likely renders templates from user/customer data, templating engine issues can become directly exploitable.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"inquirer": "^8.2.6",
    "chalk": "^4.1.2",
    "handlebars": "^4.7.8",
    "fs-extra": "^11.1.0"
  },
  "engines": {
    "node": ">=18"

• Confidence: 88% confidence
• Finding: Using a caret range for fs-extra allows unreviewed dependency changes to enter future installations, which increases supply-chain exposure. For a file-generating CLI skill, filesystem-related dependency changes can have outsized operational effects.

Known Vulnerable Dependency: handlebars==4.7.8 — 8 advisory(ies): CVE-2026-33916 (Handlebars.js has Prototype Pollution Leading to XSS through Partial Template In); CVE-2026-33937 (Handlebars.js has JavaScript Injection via AST Type Confusion); CVE-2026-33938 (Handlebars.js has JavaScript Injection via AST Type Confusion by tampering @part) +5 more

Critical

• Category: Supply Chain
• Confidence: 98% confidence
• Finding: The package depends on handlebars 4.7.8, which is explicitly identified as having multiple critical advisories including prototype pollution and code/JavaScript injection paths. This skill’s stated purpose is to generate branded HTML proposals from customer input and knowledge-base cases, so a vulnerable templating engine in this context materially increases the likelihood of XSS, template injection, or unsafe HTML generation if untrusted content reaches templates, partials, or helpers.

VirusTotal

63/63 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.