Monorepo Management

• Outcome: Review
• Latest audit: Sep 10, 2026 · 4:33 PM UTC
• Version: 1.0.0

Overview

This monorepo skill is mostly ordinary documentation, but it needs review because its install and release examples rely on mutable third-party code, including a publishing action that receives npm and GitHub tokens.

Install only from a pinned commit or trusted release, and review any generated CI workflows before use. If you adopt the publishing example, pin GitHub Actions to reviewed SHAs, add explicit least-privilege permissions, and avoid exposing broad or long-lived npm tokens where short-lived trusted publishing is available.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (4)

T08 · Insecure Dependencies

Error

• Location: README.md:29

Finding

Unpinned installer and mutable remote Skill source

Content

View full analysis

Vulnerability Details

File Location: README.md:29
Vulnerability Type: Unpinned external package execution and mutable source retrieval
Risk Level: High

Vulnerable Code

bash

npx add https://github.com/wpank/ai/tree/main/skills/backend/monorepo

Technical Analysis

This installation command invokes npx without pinning the add package to an exact, reviewed version. It also retrieves the Skill from a mutable GitHub branch rather than an immutable commit or release. The effective installer and installed content can therefore change after this audit without any modification to the audited files.

Although external retrieval is necessary for installation, executing an unresolved package and trusting a mutable branch exceeds the minimum privilege and trust required. The behavior creates a supply-chain boundary in which upstream registry or repository changes can introduce code that runs with the installing user's privileges.

Attack Path

1. An attacker compromises the package resolved by npx add, its publisher account, or the referenced GitHub repository.
2. The attacker publishes a malicious package version or modifies content on the mutable main branch.
3. A user follows the documented installation command.
4. npx retrieves and executes the currently resolved installer, which retrieves the mutable repository content.
5. Malicious installation logic can access files, environment variables, credentials, and network resources available to the invoking user.

Impact Assessment

Successful exploitation can provide arbitrary code execution under the installing user's account. The accessible scope may include project source code, user-owned files, developer credentials, package-manager tokens, SSH configuration, and other environment secrets. It does not inherently grant administrative privileges unless the command is run by an administrator or in an equivalently privileged environment.

Remediation

View remediation

Remediation Suggestions

• Replace the ambiguous npx add invocation with an explicitly identified installer pinned to an exact reviewed version.
• Reference an immutable Git commit or signed release instead of the mutable main branch.
• Publish and verify a checksum or signed provenance statement for the Skill artifact.
• Prefer a non-executing download and manual-copy procedure when installer execution is unnecessary.
• Document that installation must not be performed with elevated privileges.
• Use dependency review and controlled update automation before changing the pinned installer or source revision.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:163

Finding

Execution of an unpinned latest-version Nx workspace generator

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:163
Vulnerability Type: Unpinned package execution
Risk Level: Medium

Vulnerable Code

bash

npx create-nx-workspace@latest my-org

Technical Analysis

The command directs npx to retrieve and execute whichever package release is currently associated with the mutable latest tag. The executed artifact is not fixed to the version reviewed when the Skill was authored. Package installation scripts and the workspace generator execute locally and can perform operations beyond creating project files.

Running a workspace generator is consistent with the declared monorepo functionality, but accepting future unreviewed releases is not required. Pinning an exact version would provide the same functionality with a narrower supply-chain trust boundary.

Attack Path

1. An attacker compromises the package publisher, registry account, release process, or a dependency included by a future release.
2. A malicious release becomes the target of the latest tag.
3. A user follows the Skill and runs the documented command.
4. npx downloads and executes the compromised package.
5. Malicious lifecycle or generator code runs with the user's local permissions.

Impact Assessment

Exploitation can result in arbitrary code execution in the developer environment. The malicious package could modify the new workspace or other user-writable files, read source code and environment variables, steal development credentials, or establish outbound network connections. The maximum privilege is normally that of the invoking user.

Remediation

View remediation

Remediation Suggestions

• Replace @latest with an exact, reviewed package version.
• Verify package provenance, signatures, and integrity metadata where supported.
• Update the pinned version only through a reviewed dependency-update process.
• Run project generators in an isolated development environment with no unnecessary secrets.
• Avoid administrative execution and restrict filesystem and network access where practical.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:312

Finding

GitHub Actions workflow uses mutable major-version action references

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:312-322
Vulnerability Type: Unpinned CI dependencies
Risk Level: Medium

Vulnerable Code

yaml

- uses: actions/checkout@v4
  with:
    fetch-depth: 0    # Required for affected commands

- uses: pnpm/action-setup@v4
  with:
    version: 9

- uses: actions/setup-node@v4
  with:
    node-version: 20
    cache: "pnpm"

Technical Analysis

These workflow dependencies use mutable major-version tags rather than immutable commit SHAs. A tag can resolve to different code after review. Each action executes inside the CI job and can access the checked-out repository, runner filesystem, job environment, and any credentials made available to that job.

These actions are relevant to the documented CI workflow, but allowing their implementations to change without review exceeds the minimum required trust. The risk is particularly important for CI because action code executes automatically on workflow triggers.

Attack Path

1. An attacker compromises an action repository, maintainer account, release process, or mutable tag.
2. One of the referenced major-version tags is moved or updated to include malicious behavior.
3. A push or pull request triggers the workflow.
4. The runner downloads and executes the malicious action revision.
5. The action accesses data and credentials available in the job and may alter build outputs or workflow behavior.

Impact Assessment

Potential impact includes CI runner code execution, repository source disclosure, build or test manipulation, artifact tampering, and access to job-scoped credentials. Exact repository modification privileges depend on the workflow's token permissions and repository configuration; the example does not explicitly define those permissions.

Remediation

View remediation

Remediation Suggestions

• Pin every GitHub Action to a full reviewed commit SHA.
• Retain the release version in an adjacent comment for maintainability.
• Configure an explicit least-privilege permissions block for the workflow and each job.
• Do not expose secrets to pull-request workflows originating from untrusted forks.
• Use dependency-update automation that proposes reviewed SHA updates.
• Monitor action provenance and restrict allowed actions to trusted organizations or verified revisions.

T08 · Insecure Dependencies

Error

• Location: SKILL.md:356

Finding

Mutable publishing action receives GitHub and npm credentials

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:356-361
Vulnerability Type: Unpinned privileged CI dependency
Risk Level: High

Vulnerable Code

yaml

uses: changesets/action@v1
with:
  publish: pnpm changeset publish
env:
  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
  NPM_TOKEN: ${{ secrets.NPM_TOKEN }}

Technical Analysis

The workflow intentionally supplies GitHub and npm credentials to a third-party publishing action referenced through the mutable v1 tag. Supplying these credentials is functionally related to release publishing and is not, by itself, evidence of deliberate exfiltration. However, the mutable reference means the code receiving the credentials can change after review.

If the action repository, maintainer account, release process, or tag is compromised, a substituted action revision could read and transmit both tokens. This is the sensitive network behavior identified by the pre-scan: credentials are made available to externally maintained code that can communicate over the network.

Attack Path

1. An attacker compromises the Changesets action repository, a maintainer account, or control of the mutable v1 tag.
2. The tag is changed or updated to point to a malicious action revision.
3. An authorized release workflow runs with GITHUB_TOKEN and NPM_TOKEN present in its environment.
4. The malicious action reads the tokens and transmits them to an attacker-controlled endpoint.
5. The attacker uses the tokens within their scopes to manipulate repository releases or publish compromised npm packages.

Impact Assessment

The npm token may permit publishing or modifying packages available to that credential, enabling downstream supply-chain compromise. The GitHub token may permit repository operations allowed by the workflow's configured or default permissions, potentially including release or pull-request changes. The precise scope depends on token configuration ...[truncated 86 chars]

Remediation

View remediation

Remediation Suggestions

• Pin changesets/action to a full, reviewed commit SHA.
• Add an explicit least-privilege GitHub Actions permissions block.
• Scope the npm token to only the packages and publishing operations required.
• Prefer npm trusted publishing with short-lived OpenID Connect credentials over a long-lived NPM_TOKEN where supported.
• Protect the release environment with approval requirements and branch restrictions.
• Ensure publishing credentials are available only to the release job and never to untrusted pull-request workflows.
• Apply secret masking, credential rotation, audit logging, and alerting for unexpected publication activity.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence

Findings (11)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 11)May include surrounding context.

md

- Workspace Structure — apps/ vs packages/ convention
- Turborepo Setup — root configuration, pipeline config, package configuration
- Nx Setup — workspace generation, project generation, affected commands
- Dependency Management (pnpm) — workspace dependencies, filter patterns, .npmrc config
- Shared Configurations — TypeScript, ESLint, Prettier
- Build Optimization — remote caching, cache configuration, precise inputs
- CI/CD — GitHub Actions setup, deploy affected only

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 229)May include surrounding context.

md

- Workspace Structure — apps/ vs packages/ convention
- Turborepo Setup — root configuration, pipeline config, package configuration
- Nx Setup — workspace generation, project generation, affected commands
- Dependency Management (pnpm) — workspace dependencies, filter patterns, .npmrc config
- Shared Configurations — TypeScript, ESLint, Prettier
- Build Optimization — remote caching, cache configuration, precise inputs
- CI/CD — GitHub Actions setup, deploy affected only

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · SKILL.md (reported line 88)May include surrounding context.

md

"test": "turbo run test",
    "lint": "turbo run lint",
    "type-check": "turbo run type-check",
    "clean": "turbo run clean && rm -rf node_modules"
  },
  "devDependencies": {
    "turbo": "^2.0.0",

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The README instructs users to install directly from a remote GitHub URL using npx add without pinning to a specific immutable version, tag, or commit. That creates a supply-chain risk because the referenced repository content can change over time, causing users to fetch different code than was originally reviewed.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 39)May include surrounding context.

From your project root:

bash

mkdir -p .cursor/skills
cp -r ~/.ai-skills/skills/backend/monorepo .cursor/skills/monorepo

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 55)May include surrounding context.

From your project root:

bash

mkdir -p .claude/skills
cp -r ~/.ai-skills/skills/backend/monorepo .claude/skills/monorepo

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 62)May include surrounding context.

Claude Code (global)

bash

mkdir -p ~/.claude/skills
cp -r ~/.ai-skills/skills/backend/monorepo ~/.claude/skills/monorepo

External Model or Provider Selection

Medium

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: monorepo
model: standard
description: Build and manage monorepos with Turborepo, Nx, and pnpm workspaces — covering workspace structure, dependency management, task orchestration, caching, CI/CD, and publishing. Use when setting up monorepos, optimizing builds, or managing shared packages.
---

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.