Architecture Decision Records

• Outcome: Review
• Latest audit: Sep 10, 2026 · 4:32 PM UTC
• Version: 1.0.0

Overview

The skill content is ordinary ADR documentation, but its install instructions use an unpinned npx command from a mutable GitHub path that should be reviewed before use.

Review the install path before using this skill. Prefer manual installation from a reviewed local copy, or pin the installer to a specific trusted package version and repository commit with a checksum. The skill content itself is documentation-oriented and does not request secrets or broad runtime access.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Error

• Location: README.md:25

Finding

Unpinned Third-Party Package Execution During Installation

Content

View full analysis

Vulnerability Details

File Location: README.md, line 25
Vulnerability Type: T08: Insecure Dependencies
Risk Level: High

Vulnerable Code

bash

npx add https://github.com/wpank/ai/tree/main/skills/backend/architecture-decision-records

Technical Analysis

The installation command invokes npx, which can download and execute the npm package named add. Neither an exact package version nor an integrity hash is specified. The GitHub source is also referenced through a mutable repository path rather than a reviewed commit hash or immutable release artifact.

Consequently, the code executed during installation may differ from the code reviewed during this audit. Compromise of the npm package, its dependency chain, its publisher account, or the referenced repository could introduce arbitrary executable behavior into the installation process.

Attack Path

1. An attacker compromises the unpinned npm package, one of its dependencies, its publisher account, or the mutable remote repository.
2. The attacker publishes or inserts a malicious installation payload.
3. A user follows the documented installation command.
4. npx resolves and downloads remote package code without enforcing a reviewed version and integrity hash.
5. Package lifecycle hooks or CLI implementation code executes with the privileges of the user running the command.
6. The payload can access or modify resources available to that user.

Impact Assessment

Successful exploitation could result in arbitrary code execution with the installing user's privileges. The accessible scope may include project files, user-owned files, environment variables, developer credentials, SSH configuration, source-control tokens, and other resources available to the invoking account. The command does not itself request elevated privileges, so the direct impact is generally bounded by the permissions of the user who runs it.

Remediation

View remediation

Remediation Suggestions

1. Replace the npx command with a non-executing installation procedure that downloads or copies reviewed files.
2. Pin the GitHub source to a specific, reviewed commit hash rather than a mutable branch or repository path.
3. If a CLI package is required, use its fully qualified package name and pin an exact version.
4. Verify the package publisher and dependency tree before recommending the command.
5. Enforce package integrity through a lockfile, checksum, signed release, or equivalent verification mechanism.
6. Disable or avoid dependency lifecycle scripts where they are unnecessary.
7. Document the expected artifact checksum and provide a verification command before installation.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 7)May include surrounding context.

md

## What's Inside

- Quick Decision guide — when to write an ADR vs skip
- ADR Lifecycle — Proposed → Accepted → Deprecated → Superseded
- Templates — Standard, Full (for major decisions), Lightweight, Y-Statement (one-liner), Deprecation ADR
- Directory Structure and ADR Index conventions

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The README instructs users to install directly from a GitHub URL via npx add without pinning to a specific immutable version, tag, or commit. This creates a supply-chain risk because future changes to the referenced repository could alter what gets installed, causing users to retrieve unreviewed or potentially malicious content.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 51)May include surrounding context.

From your project root:

bash

mkdir -p .claude/skills
cp -r ~/.ai-skills/skills/backend/architecture-decision-records .claude/skills/architecture-decision-records

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 58)May include surrounding context.

Claude Code (global)

bash

mkdir -p ~/.claude/skills
cp -r ~/.ai-skills/skills/backend/architecture-decision-records ~/.claude/skills/architecture-decision-records

External Model or Provider Selection

Medium

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: architecture-decision-records-(adrs)
model: reasoning
---

# Architecture Decision Records (ADRs)

Static analysis

No suspicious patterns detected.