Command Creator

• Outcome: Review
• Latest audit: Sep 10, 2026 · 4:40 PM UTC
• Version: 0.1.0

Overview

The skill is a coherent slash-command authoring helper, but its install instructions and examples normalize high-impact automated repo actions without enough safety boundaries.

Review before installing. Prefer an immutable, pinned installation source instead of the README's `npx add` command, and be careful when using this skill to create commands that can edit files, stage all changes, create commits, publish PRs, or run project scripts. Generated commands should include explicit confirmation steps for destructive, broad, or externally visible actions.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: README.md:21
• Finding: Unpinned Third-Party Installer and Mutable Remote Source## Vulnerability Details **File Location**: `README.md`, lines 21–25 **Vulnerability Type**: Supply-chain exposure through an unpinned executable dependency and mutable remote source **Risk Level**: Medium ### Vulnerable Code ```markdown ## Installation ```bash npx add https://github.com/wpank/ai/tree/main/skills/tools/command-creator ``` ``` ### Technical Analysis The installation command invokes `npx add`, which may download and execute the npm package named `add` if an appropriate local copy is unavailable. The package is not pinned to an exact version or verified using a documented integrity value. The source artifact is also retrieved from a personal GitHub repository through the mutable `main` branch. Consequently, the content installed in the future may differ from the content covered by this audit. This creates two supply-chain trust boundaries: 1. The npm package resolved for `add`. 2. The GitHub account, repository, and mutable branch supplying the Skill. Compromise, package replacement, or malicious modification at either boundary could cause users to execute installer logic or install Skill instructions that were not reviewed. ### Attack Path 1. An attacker compromises the npm package, its publisher account, the GitHub account, or the referenced repository. 2. The attacker publishes malicious installer behavior or modifies content on the `main` branch. 3. A user follows the documented installation instructions. 4. `npx` resolves and executes the unpinned installer package. 5. The installer retrieves mutable repository content and may execute arbitrary commands or write modified files. 6. Malicious behavior runs with the privileges of the user performing the installation. ### Impact Assessment Successful exploitation could provide arbitrary code execution under the installing user's account. The resulting scope may include reading or modifying files accessible to that user, altering project or global agent configuration, stealing develop ...[truncated 265 chars]
• Remediation: ## Remediation Suggestions 1. Replace the ambiguous `npx add` invocation with a documented, trusted installer package pinned to an exact version. 2. Pin the GitHub source to a reviewed commit hash or immutable, signed release tag rather than `main`. 3. Publish and verify a cryptographic checksum for the downloaded artifact. 4. Prefer a transparent manual installation procedure that downloads a fixed archive, verifies its checksum, and copies only the expected files. 5. Use npm lockfile integrity metadata where npm dependencies are unavoidable. 6. Document the exact files and installation destinations so users can inspect changes before applying them. 7. Run installer tooling with the minimum necessary privileges and avoid privileged or system-wide execution.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (21)

Session Persistence

Medium

• Category: Rogue Agent

Content

# Command Creator

Create Claude Code slash commands — reusable markdown workflows invoked with `/command-name`. Slash commands are markdown files in `.claude/commands/` (project) or `~/.claude/commands/` (global) that expand into prompts when invoked.

## What's Inside

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The 'When to Use' section includes broad activations like 'create', 'make', 'add a slash command', 'new command', 'automate this workflow', and 'make this repeatable' without clear constraints or exclusion examples. Several of these phrases overlap with normal conversational requests and could cause unintended invocation outside a narrow slash-command creation context.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

From your project root:

```bash
mkdir -p .claude/skills
cp -r ~/.ai-skills/skills/tools/command-creator .claude/skills/command-creator
```

• Confidence: 85% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

#### Claude Code (global)

```bash
mkdir -p ~/.claude/skills
cp -r ~/.ai-skills/skills/tools/command-creator ~/.claude/skills/command-creator
```

• Confidence: 85% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

External Model or Provider Selection

Medium

• Category: Excessive Agency

Content

---
name: command-creator
model: fast
description: |
  WHAT: Create Claude Code slash commands - reusable markdown workflows invoked with /command-name.

• Confidence: 90% confidence
• Finding: Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Session Persistence

Medium

• Category: Rogue Agent

Content

name: command-creator
model: fast
description: |
  WHAT: Create Claude Code slash commands - reusable markdown workflows invoked with /command-name.
  
  WHEN: User wants to create, make, or add a slash command. User wants to automate a repetitive workflow or document a consistent process for reuse.

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The activation description includes generic intents like "create," "make," "add a command," and "new command," plus broad phrases such as "automate this workflow" and "make this repeatable." These phrases are not tightly scoped and could match ordinary user requests that are not specifically asking to invoke this skill, increasing the risk of unintended activation.

Intent-Code Divergence

Medium

• Confidence: 98% confidence
• Finding: The guidance first says to use the Bash tool for make commands, then immediately says 'DO NOT use Bash tool for make commands.' This is an active contradiction in the documentation, not merely an omission, and could cause the generated command behavior to diverge from the stated intent of clear, reliable command-authoring guidance.

Session Persistence

Medium

• Category: Rogue Agent

Content

```markdown
## Progress Reporting

Use TodoWrite to track your progress:

- Create todos at the start for each iteration
- Mark as in_progress when starting

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The document instructs authors to use editing operations on user files but does not require transparent disclosure that the resulting command may modify local files. In a reusable slash-command ecosystem, omission of that warning can cause unexpected integrity-impacting changes and reduce user ability to make informed decisions before invocation.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The guidance encourages state-changing git operations such as staging and committing without requiring an explicit warning, confirmation boundary, or disclosure that repository state will be modified. In an agent-executed command context, this can lead users to invoke workflows that silently alter version-control state, creating integrity and change-management risks.

Intent-Code Divergence

Medium

• Confidence: 99% confidence
• Finding: This section again instructs readers to 'ALWAYS use Bash tool' for make commands and then says 'DO NOT use Bash tool for make commands.' Because this file is supposed to provide authoritative best practices for creating commands, the contradiction undermines the documented intent and may lead to malformed generated commands.

Intent-Code Divergence

Medium

• Confidence: 99% confidence
• Finding: The section labeled as the correct approach tells the reader to use Bash for make commands, then ends with 'DO NOT use Bash tool for make commands.' Labeling a self-contradictory example as correct is an explicit intent/documentation divergence that can mislead downstream command creation.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

9. **Track progress** (TodoWrite for multi-step)
10. **Verify each step** (check results before proceeding)

Focus on creating commands that agents can execute autonomously without asking clarifying questions.

• Confidence: 84% confidence
• Finding: The directive to create commands that execute autonomously without asking clarifying questions increases the chance that agents will make consequential decisions under ambiguity. In combination with examples involving edits, git staging, commits, and command execution, this can amplify unsafe actions and reduce human oversight at precisely the points where confirmation is most valuable.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: This example instructs non-interactive remote operations (`gt submit --stack --publish --no-edit --restack`) that can create or update pull requests and publish drafts without an explicit warning or approval step. In a command-creation skill, examples strongly shape generated commands, so this normalizes potentially broad remote side effects that could expose code, trigger CI, or alter multiple PRs unexpectedly.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: This example explicitly instructs the agent to run `git add .` and `git commit` as part of the workflow, which modifies the repository state and may capture unintended files, secrets, or unrelated changes. Because the example is presented as a reusable command reference without a clear user-confirmation checkpoint or warning about write side effects, downstream commands modeled on it may perform irreversible local changes too eagerly.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The document explicitly includes patterns that create commits, submit PRs, and otherwise modify repository state, but it does not require user confirmation or warn that these actions can have irreversible side effects. In a command-creation skill, these examples may be copied into generated commands, causing downstream automation to perform write or network actions without an explicit safety checkpoint.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The document recommends direct Bash execution for tools like make, pytest, pyright, and gt without warning that shell commands may execute arbitrary project-defined scripts, hooks, or networked operations. In the context of a command-authoring skill, this is more dangerous because it can propagate a norm of executing shell commands from untrusted repositories without validating side effects first.

Missing User Warnings

Low

• Confidence: 87% confidence
• Finding: The pattern instructs saving results to disk after approval, but it does not consistently frame file writes as a sensitive operation requiring explicit disclosure of the target path and overwrite behavior. In a skill whose purpose is to generate reusable commands, omission of those safeguards can normalize unsafe write patterns in derived commands.

Scope Creep

Low

• Category: Excessive Agency

Content

- Identify if deeper work needed

2. If issues found:
   - Expand scope progressively
   - Add todos for each issue category
   - Handle incrementally

• Confidence: 75% confidence
• Finding: Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Static analysis

No suspicious patterns detected.