Security checks for vulnerabilities and agentic risk
Overview
The skill content is ordinary loading-state UI guidance, but its documented install command uses an unpinned executable installer and mutable GitHub source.
Review or avoid the `npx add` installation command unless you can pin the installer and source to a trusted exact version or commit. Manual installation from already-reviewed local files is lower risk; expect the skill to provide frontend loading UI patterns only.
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
T08 · Insecure Dependencies
Warning
Location
README.md:24
Finding
Unpinned Third-Party Installer and Mutable Remote Source
Content
View full analysis
Remediation
View remediation
```
2. Replace the mutable `main` branch reference with an immutable, reviewed commit SHA.
3. Publish and verify a cryptographic checksum or signature for the downloaded skill content.
4. Prefer a narrowly scoped installation script maintained within the audited repository over a generic third-party installer.
5. Review the package metadata and lifecycle scripts before execution. Where feasible, download and inspect the package first rather than allowing `npx` to execute it immediately.
6. Run installation with an unprivileged account in an isolated environment, without sensitive credentials in environment variables.
7. Document the expected files and their hashes so users can verify that installation produced only the intended skill content.
]]>
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content
No source excerpt is available for this finding.
Session Persistence
Medium
Category
Rogue Agent
Confidence
60% confidence
Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content
Scanner excerpt · README.md (reported line 35)May include surrounding context.
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content
Scanner excerpt · README.md (reported line 51)May include surrounding context.
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content
Scanner excerpt · README.md (reported line 58)May include surrounding context.
Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.
Content
Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.
md
---
name: loading-state-patterns
model: fast
description: Patterns for skeleton loaders, shimmer effects, and loading states that match design system aesthetics. Covers skeleton components, shimmer animations, and progressive loading. Use when building polished loading experiences. Triggers on skeleton, loading state, shimmer, placeholder, loading animation.
---
Vague Triggers
Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding
The skill description uses broad trigger terms like 'skeleton', 'loading state', 'shimmer', and 'placeholder' without narrowing context, which can cause the agent to invoke this skill in unrelated situations. Over-broad activation increases the chance of inappropriate skill selection, leading to degraded behavior or prompt-surface expansion in contexts where UI loading patterns are not actually requested.
