Monorepo Management

• Outcome: Review
• Latest audit: Sep 10, 2026 · 4:33 PM UTC
• Version: 1.0.0

Overview

This monorepo skill is mostly ordinary documentation, but it needs review because its install and release examples rely on mutable third-party code, including a publishing action that receives npm and GitHub tokens.

Install only from a pinned commit or trusted release, and review any generated CI workflows before use. If you adopt the publishing example, pin GitHub Actions to reviewed SHAs, add explicit least-privilege permissions, and avoid exposing broad or long-lived npm tokens where short-lived trusted publishing is available.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (4)

T08 · Insecure Dependencies

Error

• Location: README.md:29
• Finding: Unpinned installer and mutable remote Skill source## Vulnerability Details **File Location**: `README.md:29` **Vulnerability Type**: Unpinned external package execution and mutable source retrieval **Risk Level**: High ### Vulnerable Code ```bash npx add https://github.com/wpank/ai/tree/main/skills/backend/monorepo ``` ### Technical Analysis This installation command invokes `npx` without pinning the `add` package to an exact, reviewed version. It also retrieves the Skill from a mutable GitHub branch rather than an immutable commit or release. The effective installer and installed content can therefore change after this audit without any modification to the audited files. Although external retrieval is necessary for installation, executing an unresolved package and trusting a mutable branch exceeds the minimum privilege and trust required. The behavior creates a supply-chain boundary in which upstream registry or repository changes can introduce code that runs with the installing user's privileges. ### Attack Path 1. An attacker compromises the package resolved by `npx add`, its publisher account, or the referenced GitHub repository. 2. The attacker publishes a malicious package version or modifies content on the mutable `main` branch. 3. A user follows the documented installation command. 4. `npx` retrieves and executes the currently resolved installer, which retrieves the mutable repository content. 5. Malicious installation logic can access files, environment variables, credentials, and network resources available to the invoking user. ### Impact Assessment Successful exploitation can provide arbitrary code execution under the installing user's account. The accessible scope may include project source code, user-owned files, developer credentials, package-manager tokens, SSH configuration, and other environment secrets. It does not inherently grant administrative privileges unless the command is run by an administrator or in an equivalently privileged environment.
• Remediation: ## Remediation Suggestions - Replace the ambiguous `npx add` invocation with an explicitly identified installer pinned to an exact reviewed version. - Reference an immutable Git commit or signed release instead of the mutable `main` branch. - Publish and verify a checksum or signed provenance statement for the Skill artifact. - Prefer a non-executing download and manual-copy procedure when installer execution is unnecessary. - Document that installation must not be performed with elevated privileges. - Use dependency review and controlled update automation before changing the pinned installer or source revision.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:163
• Finding: Execution of an unpinned latest-version Nx workspace generator## Vulnerability Details **File Location**: `SKILL.md:163` **Vulnerability Type**: Unpinned package execution **Risk Level**: Medium ### Vulnerable Code ```bash npx create-nx-workspace@latest my-org ``` ### Technical Analysis The command directs `npx` to retrieve and execute whichever package release is currently associated with the mutable `latest` tag. The executed artifact is not fixed to the version reviewed when the Skill was authored. Package installation scripts and the workspace generator execute locally and can perform operations beyond creating project files. Running a workspace generator is consistent with the declared monorepo functionality, but accepting future unreviewed releases is not required. Pinning an exact version would provide the same functionality with a narrower supply-chain trust boundary. ### Attack Path 1. An attacker compromises the package publisher, registry account, release process, or a dependency included by a future release. 2. A malicious release becomes the target of the `latest` tag. 3. A user follows the Skill and runs the documented command. 4. `npx` downloads and executes the compromised package. 5. Malicious lifecycle or generator code runs with the user's local permissions. ### Impact Assessment Exploitation can result in arbitrary code execution in the developer environment. The malicious package could modify the new workspace or other user-writable files, read source code and environment variables, steal development credentials, or establish outbound network connections. The maximum privilege is normally that of the invoking user.
• Remediation: ## Remediation Suggestions - Replace `@latest` with an exact, reviewed package version. - Verify package provenance, signatures, and integrity metadata where supported. - Update the pinned version only through a reviewed dependency-update process. - Run project generators in an isolated development environment with no unnecessary secrets. - Avoid administrative execution and restrict filesystem and network access where practical.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:312
• Finding: GitHub Actions workflow uses mutable major-version action references## Vulnerability Details **File Location**: `SKILL.md:312-322` **Vulnerability Type**: Unpinned CI dependencies **Risk Level**: Medium ### Vulnerable Code ```yaml - uses: actions/checkout@v4 with: fetch-depth: 0 # Required for affected commands - uses: pnpm/action-setup@v4 with: version: 9 - uses: actions/setup-node@v4 with: node-version: 20 cache: "pnpm" ``` ### Technical Analysis These workflow dependencies use mutable major-version tags rather than immutable commit SHAs. A tag can resolve to different code after review. Each action executes inside the CI job and can access the checked-out repository, runner filesystem, job environment, and any credentials made available to that job. These actions are relevant to the documented CI workflow, but allowing their implementations to change without review exceeds the minimum required trust. The risk is particularly important for CI because action code executes automatically on workflow triggers. ### Attack Path 1. An attacker compromises an action repository, maintainer account, release process, or mutable tag. 2. One of the referenced major-version tags is moved or updated to include malicious behavior. 3. A push or pull request triggers the workflow. 4. The runner downloads and executes the malicious action revision. 5. The action accesses data and credentials available in the job and may alter build outputs or workflow behavior. ### Impact Assessment Potential impact includes CI runner code execution, repository source disclosure, build or test manipulation, artifact tampering, and access to job-scoped credentials. Exact repository modification privileges depend on the workflow's token permissions and repository configuration; the example does not explicitly define those permissions.
• Remediation: ## Remediation Suggestions - Pin every GitHub Action to a full reviewed commit SHA. - Retain the release version in an adjacent comment for maintainability. - Configure an explicit least-privilege `permissions` block for the workflow and each job. - Do not expose secrets to pull-request workflows originating from untrusted forks. - Use dependency-update automation that proposes reviewed SHA updates. - Monitor action provenance and restrict allowed actions to trusted organizations or verified revisions.

T08 · Insecure Dependencies

Error

• Location: SKILL.md:356
• Finding: Mutable publishing action receives GitHub and npm credentials## Vulnerability Details **File Location**: `SKILL.md:356-361` **Vulnerability Type**: Unpinned privileged CI dependency **Risk Level**: High ### Vulnerable Code ```yaml uses: changesets/action@v1 with: publish: pnpm changeset publish env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} NPM_TOKEN: ${{ secrets.NPM_TOKEN }} ``` ### Technical Analysis The workflow intentionally supplies GitHub and npm credentials to a third-party publishing action referenced through the mutable `v1` tag. Supplying these credentials is functionally related to release publishing and is not, by itself, evidence of deliberate exfiltration. However, the mutable reference means the code receiving the credentials can change after review. If the action repository, maintainer account, release process, or tag is compromised, a substituted action revision could read and transmit both tokens. This is the sensitive network behavior identified by the pre-scan: credentials are made available to externally maintained code that can communicate over the network. ### Attack Path 1. An attacker compromises the Changesets action repository, a maintainer account, or control of the mutable `v1` tag. 2. The tag is changed or updated to point to a malicious action revision. 3. An authorized release workflow runs with `GITHUB_TOKEN` and `NPM_TOKEN` present in its environment. 4. The malicious action reads the tokens and transmits them to an attacker-controlled endpoint. 5. The attacker uses the tokens within their scopes to manipulate repository releases or publish compromised npm packages. ### Impact Assessment The npm token may permit publishing or modifying packages available to that credential, enabling downstream supply-chain compromise. The GitHub token may permit repository operations allowed by the workflow's configured or default permissions, potentially including release or pull-request changes. The precise scope depends on token configuration ...[truncated 86 chars]
• Remediation: ## Remediation Suggestions - Pin `changesets/action` to a full, reviewed commit SHA. - Add an explicit least-privilege GitHub Actions `permissions` block. - Scope the npm token to only the packages and publishing operations required. - Prefer npm trusted publishing with short-lived OpenID Connect credentials over a long-lived `NPM_TOKEN` where supported. - Protect the release environment with approval requirements and branch restrictions. - Ensure publishing credentials are available only to the release job and never to untrusted pull-request workflows. - Apply secret masking, credential rotation, audit logging, and alerting for unexpected publication activity.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence

Findings (11)

Credential Access

High

• Category: Privilege Escalation

Content

- Workspace Structure — apps/ vs packages/ convention
- Turborepo Setup — root configuration, pipeline config, package configuration
- Nx Setup — workspace generation, project generation, affected commands
- Dependency Management (pnpm) — workspace dependencies, filter patterns, .npmrc config
- Shared Configurations — TypeScript, ESLint, Prettier
- Build Optimization — remote caching, cache configuration, precise inputs
- CI/CD — GitHub Actions setup, deploy affected only

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

- Workspace Structure — apps/ vs packages/ convention
- Turborepo Setup — root configuration, pipeline config, package configuration
- Nx Setup — workspace generation, project generation, affected commands
- Dependency Management (pnpm) — workspace dependencies, filter patterns, .npmrc config
- Shared Configurations — TypeScript, ESLint, Prettier
- Build Optimization — remote caching, cache configuration, precise inputs
- CI/CD — GitHub Actions setup, deploy affected only

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Chaining Abuse

High

• Category: Tool Misuse

Content

"test": "turbo run test",
    "lint": "turbo run lint",
    "type-check": "turbo run type-check",
    "clean": "turbo run clean && rm -rf node_modules"
  },
  "devDependencies": {
    "turbo": "^2.0.0",

• Confidence: 75% confidence
• Finding: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence
• Finding: The README instructs users to install directly from a remote GitHub URL using `npx add` without pinning to a specific immutable version, tag, or commit. That creates a supply-chain risk because the referenced repository content can change over time, causing users to fetch different code than was originally reviewed.

Session Persistence

Medium

• Category: Rogue Agent

Content

From your project root:

```bash
mkdir -p .cursor/skills
cp -r ~/.ai-skills/skills/backend/monorepo .cursor/skills/monorepo
```

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

From your project root:

```bash
mkdir -p .claude/skills
cp -r ~/.ai-skills/skills/backend/monorepo .claude/skills/monorepo
```

• Confidence: 85% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

#### Claude Code (global)

```bash
mkdir -p ~/.claude/skills
cp -r ~/.ai-skills/skills/backend/monorepo ~/.claude/skills/monorepo
```

• Confidence: 85% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

External Model or Provider Selection

Medium

• Category: Excessive Agency

Content

---
name: monorepo
model: standard
description: Build and manage monorepos with Turborepo, Nx, and pnpm workspaces — covering workspace structure, dependency management, task orchestration, caching, CI/CD, and publishing. Use when setting up monorepos, optimizing builds, or managing shared packages.
---

• Confidence: 90% confidence
• Finding: Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Static analysis

No suspicious patterns detected.