Backend Event Stores

• Outcome: Review
• Latest audit: Sep 10, 2026 · 4:32 PM UTC
• Version: 1.0.0

Overview

The skill content is a straightforward event-store guide, but its README recommends an unpinned npx/GitHub install command that could run unreviewed code.

Install only from reviewed, pinned content rather than the unpinned `npx add` command. Treat the code samples as design sketches, and add explicit concurrency checks plus idempotency safeguards before production use.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: README.md:27

Finding

Unpinned Third-Party Installation Through npx and a Mutable GitHub Source

Content

View full analysis

Vulnerability Details

File Location: README.md, lines 27–31
Vulnerability Type: Supply-chain risk caused by an unpinned executable package and mutable remote source
Risk Level: Medium

Vulnerable Code Snippet:

markdown

## Installation

```bash
npx add https://github.com/wpank/ai/tree/main/skills/backend/event-store

text

### Technical Analysis

The installation command invokes `npx`, which may download and execute the npm package named `add` when it is not already available locally. The package is not pinned to an exact version and no lockfile integrity value or checksum is supplied.

The command also references the mutable `main` branch of a remote GitHub repository rather than a reviewed commit SHA. Consequently, the code and files retrieved when a user runs this command may differ from the two documentation files examined during this audit.

This creates two independent supply-chain trust points:

1. The package that `npx` resolves and executes.
2. The mutable content obtained from the remote GitHub repository.

Compromise, malicious publication, ownership transfer, or an unexpected update at either point could cause unreviewed code to be processed or executed on the user's machine.

### Attack Path

1. An attacker compromises the resolved npm package, publishes a malicious version under the package name, or compromises the referenced GitHub repository.
2. The attacker adds malicious package lifecycle behavior, installer logic, or skill content.
3. A user follows the installation instruction in `README.md`.
4. `npx` resolves and potentially downloads the unpinned package, then executes it with the user's privileges.
5. The installer retrieves content from the mutable GitHub `main` branch.
6. The malicious component can act within the permissions and environment available to the invoking user.

### Impact Assessment

Successful exploitation could permit arbitrary actions under the 
...[truncated 514 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the ambiguous npx add command with a trusted and explicitly documented installer.
2. Pin the installer package to an exact reviewed version, for example package-name@x.y.z, rather than allowing resolution of the latest release.
3. Pin the GitHub source to a reviewed commit SHA instead of the mutable main branch.
4. Publish and verify a cryptographic checksum or signed release artifact before installation.
5. Disable or avoid package lifecycle scripts where they are unnecessary.
6. Prefer a transparent file-copy installation method for this documentation-only skill.
7. Document the exact files that will be installed and the permissions required.
8. Perform installation with least privilege and avoid running the command with administrative or root permissions.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (8)

Memory Manipulation

High

• Category: Memory Poisoning
• Confidence: 90% confidence

Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · SKILL.md (reported line 252)May include surrounding context.

md

### Projection Design Rules

- **Idempotent handlers** — replaying the same event twice must not corrupt state
- **One projection per read model** — keep projections focused
- **Rebuild from scratch** — projections should be deletable and fully replayable
- **Separate storage** — projections can live in different databases (Postgres, Elasticsearch, Redis)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The README instructs users to install the skill via npx add from a GitHub URL without any version pinning or immutable reference. This creates a supply-chain risk because future changes to the referenced repository or branch could cause users to fetch and install different content than originally reviewed.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 40)May include surrounding context.

From your project root:

bash

mkdir -p .cursor/skills
cp -r ~/.ai-skills/skills/backend/event-store .cursor/skills/event-store

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 56)May include surrounding context.

From your project root:

bash

mkdir -p .claude/skills
cp -r ~/.ai-skills/skills/backend/event-store .claude/skills/event-store

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 63)May include surrounding context.

Claude Code (global)

bash

mkdir -p ~/.claude/skills
cp -r ~/.ai-skills/skills/backend/event-store ~/.claude/skills/event-store

External Model or Provider Selection

Medium

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: event-store
model: standard
description: Design and implement event stores for event-sourced systems. Use when building event sourcing infrastructure, implementing event persistence, projections, snapshotting, or CQRS patterns.
---

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill explicitly says to never skip version checks on append, yet the EventStoreDB example uses an unconditional append mode when expected_revision is None. In an event-sourced system, this can permit lost updates or conflicting writes under concurrency, undermining stream integrity and making the example unsafe for readers to copy into production.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The document warns against random UUID event IDs without idempotency checks, but multiple examples generate fresh UUIDs and do not demonstrate deduplication or uniqueness enforcement based on client-supplied event IDs. In retry scenarios, this can create duplicate events, causing double-processing, inconsistent projections, and incorrect business outcomes.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.