database-migrations

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 4:32 PM UTC
• Version: 1.0.0

Overview

This is a coherent documentation-only database migration skill, with the main caution being an unpinned remote install command in the README.

The skill content itself is low risk and focused on database migration safety. Before installing, prefer a pinned release or commit and inspect the downloaded files, especially if using the npx command or installing globally into an agent's skill directory.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: README.md:29

Finding

Unpinned Third-Party Installation Command

Content

View full analysis

Vulnerability Details

File Location: README.md, lines 29–33
Vulnerability Type: Supply-chain risk from unpinned remote dependencies
Risk Level: Medium

Vulnerable Code

bash

npx add https://github.com/wpank/ai/tree/main/skills/api/database-migrations

Technical Analysis

The installation command invokes the add package through npx without specifying an exact package version. It also obtains the Skill from the mutable main branch of an external GitHub repository rather than an immutable commit.

Consequently, the package executed by npx and the remote Skill content can change after this project has been reviewed. The command does not perform checksum, signature, or provenance verification. This creates a supply-chain trust gap: a compromised npm package, npm account, GitHub repository, or maintainer account could cause users to execute altered installation logic or install malicious Skill content.

No evidence establishes that either current remote source is malicious. The vulnerability is the unsafe, unpinned installation mechanism.

Attack Path

1. An attacker compromises the npm package/account used by npx, the referenced GitHub repository, or a maintainer account.
2. The attacker publishes malicious installer behavior or modifies content under the mutable main branch.
3. A user follows the documented installation command.
4. npx resolves and executes the package available at that time, which retrieves or processes the mutable remote source.
5. Attacker-controlled logic may execute with the installing user's privileges, or malicious Skill instructions may be placed in the user's agent configuration.

Impact Assessment

Successful exploitation could execute commands with the privileges of the user running the installation, read or modify files accessible to that user, alter project or global AI-agent configuration, and install attacker-controlled Skill instructions. If t ...[truncated 216 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the installer package to an exact, reviewed version rather than allowing npx to resolve the current release.
2. Reference an immutable Git commit or signed release tag instead of the mutable main branch.
3. Verify downloaded content with a published cryptographic checksum or signature before installation.
4. Prefer downloading and inspecting a fixed archive followed by a non-executable copy operation when installer-time code execution is unnecessary.
5. Use a trusted package registry and enforce package provenance or signature validation where supported.
6. Run installation with least privilege in an isolated environment, without production credentials or unnecessary filesystem access.
7. Document the expected package version, source commit, and integrity digest so users can reproduce the audited installation.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 13)May include surrounding context.

md

- Rollback Strategies — reversible, forward-only, hybrid approaches
- Data Preservation — soft-delete, snapshot tables, point-in-time recovery, logical backups
- Blue-Green Database pattern
- Data Migration Patterns — backfill strategies, batch processing, dual-write period
- Testing Migrations — production-like data, migration CI pipeline
- Migration Checklist — pre-migration, during, and post-migration steps

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

The installation command uses a remote GitHub URL via npx add without any pinned version, commit, or integrity mechanism. That creates a supply-chain risk: future upstream changes, repository compromise, or dependency substitution could cause users to install different or malicious content than what was reviewed.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 55)May include surrounding context.

From your project root:

bash

mkdir -p .claude/skills
cp -r ~/.ai-skills/skills/api/database-migrations .claude/skills/database-migrations

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 62)May include surrounding context.

Claude Code (global)

bash

mkdir -p ~/.claude/skills
cp -r ~/.ai-skills/skills/api/database-migrations ~/.claude/skills/database-migrations

External Model or Provider Selection

Medium

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: database-migrations
model: standard
description: Safe, zero-downtime database migration strategies — schema evolution, rollback planning, data migration, tooling, and anti-pattern avoidance for production systems. Use when planning schema changes, writing migrations, or reviewing migration safety.
---

Static analysis

No suspicious patterns detected.