API Rate Limiting

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 4:32 PM UTC
• Version: 1.0.0

Overview

This is a coherent educational rate-limiting skill with a supply-chain caution in its README install command, but no evidence of hidden runtime behavior or malicious instructions.

The skill content itself is low-risk educational material. Before installing, avoid running the unpinned `npx add` command blindly; prefer a pinned commit or a manually verified copy of the reviewed files, especially in sensitive projects.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: README.md:30

Finding

Unpinned Third-Party Installer and Mutable Remote Source

Content

View full analysis

Vulnerability Details

File Location: README.md, lines 29-31
Vulnerability Type: Supply-chain risk from an unpinned installer and mutable remote dependency
Risk Level: Medium

Vulnerable Code:

bash

npx add https://github.com/wpank/ai/tree/main/skills/api/rate-limiting

Technical Analysis

The installation command invokes npx add without pinning the add package to a specific, reviewed version. If the package is not already available locally, npx may retrieve and execute it from the npm registry with the permissions of the user running the command.

The content to install is also referenced through the mutable Git branch main, rather than an immutable commit hash or signed release. Consequently, the effective package and Skill content executed or installed can change after this repository has been reviewed. No checksum, signature, lock file, or other integrity-verification mechanism is provided.

This creates two supply-chain trust boundaries:

1. The unpinned npm package resolved for add.
2. The mutable third-party GitHub repository content referenced through main.

Compromise of the relevant npm package, publisher account, GitHub repository, maintainer account, or branch could alter the content delivered to users.

Attack Path

1. An attacker compromises the npm package, its publisher account, the referenced GitHub repository, or a maintainer account.
2. The attacker publishes a malicious package version or modifies content on the main branch.
3. A user follows the documented installation command.
4. npx resolves and executes the unpinned installer package, which processes content from the mutable remote source.
5. The malicious installer or remote content executes code or installs modified Skill instructions in the user's environment.

Impact Assessment

Successful exploitation could execute arbitrary code with the privileges of the user running the installation ...[truncated 539 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the ambiguous npx add invocation with a documented and trusted installer pinned to an exact package version.
2. Pin the GitHub source to a reviewed immutable commit hash instead of the mutable main branch.
3. Publish and verify a cryptographic checksum or signature for the downloaded Skill content.
4. Use npm lock files and integrity metadata where an npm-based installer is required.
5. Prefer a transparent installation procedure that downloads reviewed files without executing an unrelated package.
6. Document the expected file list and hashes so users can verify the installed content before loading the Skill.
7. Advise users to perform installation with least privilege and never through an administrative or root account.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 40)May include surrounding context.

From your project root:

bash

mkdir -p .cursor/skills
cp -r ~/.ai-skills/skills/api/rate-limiting .cursor/skills/rate-limiting

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 56)May include surrounding context.

From your project root:

bash

mkdir -p .claude/skills
cp -r ~/.ai-skills/skills/api/rate-limiting .claude/skills/rate-limiting

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 63)May include surrounding context.

Claude Code (global)

bash

mkdir -p ~/.claude/skills
cp -r ~/.ai-skills/skills/api/rate-limiting ~/.claude/skills/rate-limiting

External Model or Provider Selection

Medium

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: rate-limiting
model: standard
description: Rate limiting algorithms, implementation strategies, HTTP conventions, tiered limits, distributed patterns, and client-side handling. Use when protecting APIs from abuse, implementing usage tiers, or configuring gateway-level throttling.
---

Static analysis

No suspicious patterns detected.