Quality Gates

• Outcome: Review
• Latest audit: Sep 10, 2026 · 4:39 PM UTC
• Version: 0.1.0

Overview

The skill itself is a coherent quality-gates guide, but its documented installation and setup commands rely on unpinned executable packages and mutable remote content.

Install only from a trusted, pinned source. Prefer a reviewed ClawHub package or an immutable commit/tag with checksum verification, and replace the example `npx` commands with pinned project dev dependencies and lockfile-backed package scripts before adopting the hooks.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Error

• Location: README.md:26
• Finding: Unpinned Third-Party Installer Execution Through npx## Vulnerability Details **File Location**: `README.md`, lines 26-28 **Vulnerability Type**: Unpinned package execution and mutable remote source **Risk Level**: High ```bash npx add https://github.com/wpank/ai/tree/main/skills/testing/quality-gates ``` ### Technical Analysis The installation command asks `npx` to resolve and execute a package named `add` without specifying an exact version or ensuring that a trusted local copy is installed. Depending on the environment and npm configuration, `npx` can download the current package from the npm registry and execute its entry point. The skill source is also identified by a GitHub branch path rather than an immutable commit or cryptographically verified release artifact. Consequently, both the installer and the content it processes can change after this skill has been reviewed. This creates a software supply-chain boundary in which mutable third-party content receives local code-execution capability. Exploitation would require compromise or malicious control of the resolved npm package, its dependency chain, the referenced upstream source, or the relevant package-resolution infrastructure. ### Attack Path 1. An attacker compromises or publishes malicious content through the unpinned `add` package, one of its dependencies, or the mutable upstream repository source. 2. A developer follows the documented installation command. 3. `npx` resolves and downloads the current third-party package when no trusted local version is available. 4. The downloaded package executes with the developer's privileges and processes the mutable GitHub source. 5. Malicious installer or lifecycle code accesses available repository files, environment variables, developer credentials, or modifies local files. ### Impact Assessment Successful exploitation can provide arbitrary code execution with the privileges of the developer or CI account running the command. The accessible scope can include the c ...[truncated 264 chars]
• Remediation: ## Remediation Suggestions - Replace the generic `npx add` flow with a documented and trusted installation mechanism. - Pin the installer to an exact reviewed version and commit the resulting lockfile where applicable. - Reference the skill through an immutable release tag or, preferably, a full commit digest. - Download release artifacts only from trusted locations and verify a published cryptographic checksum or signature before installation. - Use `npx --no-install` when execution must be restricted to an already installed and reviewed local dependency. - In CI, restrict package lifecycle scripts, network access, credentials, and filesystem permissions during installation. - Document the expected package name, version, source digest, and verification procedure so package substitution is detectable.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:47
• Finding: Unpinned Development Tools Executed Through npx## Vulnerability Details **File Location**: `SKILL.md`, lines 47-50 **Vulnerability Type**: Unsafe resolution and execution of unpinned development dependencies **Risk Level**: Medium ```bash npx husky init echo "npx lint-staged" > .husky/pre-commit ``` ### Technical Analysis The example invokes `husky` through `npx` without an exact version and writes a Git pre-commit hook that invokes `lint-staged` in the same way. If trusted local dependencies are absent, `npx` may retrieve executable package content from the configured npm registry. The generated hook becomes part of the local development workflow and executes when a commit is attempted. Although a normal locked project installation can cause `npx` to select a local binary, the example does not require locked, reviewed local versions or prevent registry fallback. Package compromise, dependency confusion, registry configuration manipulation, or later malicious upstream releases could therefore convert these routine commands into a code-execution path. ### Attack Path 1. An attacker compromises the relevant npm package, dependency chain, registry account, or package-resolution configuration. 2. A developer runs `npx husky init` without a trusted local Husky installation. 3. `npx` retrieves and executes attacker-controlled package content with the developer's privileges. 4. Alternatively, the generated pre-commit hook is installed successfully. 5. During a later commit, `npx lint-staged` resolves an untrusted package because a reviewed local dependency is unavailable or package resolution has been manipulated. 6. The malicious package executes in the repository context and can read or modify resources available to the invoking account. ### Impact Assessment Successful exploitation can yield arbitrary code execution under the developer or CI identity. The attacker could read source code, alter staged or working-tree files, steal environment variables and accessibl ...[truncated 271 chars]
• Remediation: ## Remediation Suggestions - Add Husky and lint-staged as explicitly pinned development dependencies using the project's package manager. - Commit and enforce a lockfile, and use deterministic installation commands such as `npm ci`. - Invoke only project-local binaries through package scripts or use `npx --no-install` to prohibit registry fallback. - Configure the pre-commit hook to call a locked package script rather than resolving a potentially absent package dynamically. - Review dependency provenance and integrity metadata before upgrades. - Use automated dependency scanning and controlled update workflows for these development tools. - Run installation and hook commands with least privilege and without unrelated production credentials in the environment.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match

Findings (9)

YARA rule 'agent_skill_prompt_injection_hidden_instructions': Prompt injection or hidden instructions embedded in AI agent skill text [agent_skills]

High

• Category: YARA Match

Content

---
name: quality-gates
model: fast
category: testing
description: Quality checkpoints at every development stage — pre-commit through post-deploy — with configuration examples, threshold tables, bypass protocols, and CI/CD integration. Use when setting up quality automation, configuring CI pipelines, establishing coverage thresholds, or defining deployment requirements.
version: 1.0
---

# Quality Gates

Enforce quality checkpoints at every stage of the development lifecycle. Each gate defines what is checked, when it runs, and whether it blocks progression.

---

## When to Use

- **Before committing** — catc

• Confidence: 80% confidence
• Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Instruction Override

High

• Category: Prompt Injection

Content

3. **NEVER skip tests to unblock a deploy** — if tests fail, the code is not ready
4. **NEVER merge with failing required checks** — admin merge bypasses erode team trust
5. **NEVER set coverage thresholds to 0%** — even a low threshold is better than none
6. **NEVER bypass security scans for speed** — vulnerabilities in production cost far more than CI minutes
7. **NEVER rely solely on post-deploy gates** — catching issues after users are impacted is damage control, not quality
8. **NEVER treat alerting gates as optional** — post-deploy monitoring exists because pre-deploy gates cannot catch everything; ignoring alerts defeats the purpose

• Confidence: 90% confidence
• Finding: This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence
• Finding: The README instructs users to install from a remote GitHub source via `npx add` without any pinned version, commit, or integrity mechanism. That creates a supply-chain risk because the referenced content can change over time, so a future malicious or compromised update could be fetched and executed under the user's trust.

Session Persistence

Medium

• Category: Rogue Agent

Content

From your project root:

```bash
mkdir -p .cursor/skills
cp -r ~/.ai-skills/skills/testing/quality-gates .cursor/skills/quality-gates
```

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

From your project root:

```bash
mkdir -p .claude/skills
cp -r ~/.ai-skills/skills/testing/quality-gates .claude/skills/quality-gates
```

• Confidence: 85% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

#### Claude Code (global)

```bash
mkdir -p ~/.claude/skills
cp -r ~/.ai-skills/skills/testing/quality-gates ~/.claude/skills/quality-gates
```

• Confidence: 85% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

External Model or Provider Selection

Medium

• Category: Excessive Agency

Content

---
name: quality-gates
model: fast
category: testing
description: Quality checkpoints at every development stage — pre-commit through post-deploy — with configuration examples, threshold tables, bypass protocols, and CI/CD integration. Use when setting up quality automation, configuring CI pipelines, establishing coverage thresholds, or defining deployment requirements.
version: 1.0

• Confidence: 90% confidence
• Finding: Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Static analysis

No suspicious patterns detected.