Service Layer Architecture

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 4:32 PM UTC
• Version: 1.0.0

Overview

This is a straightforward architecture guidance skill, with no hidden runtime behavior, though its README installation command should be treated cautiously because it is unpinned.

Before installing, prefer a pinned release or reviewed commit instead of the README's unpinned npx command from main. The skill content itself is documentation-style architecture guidance and does not show hidden execution, credential access, data exfiltration, or destructive behavior.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: README.md:23

Finding

Unpinned Third-Party Installer Execution

Content

View full analysis

Vulnerability Details

File Location: README.md, lines 23-25
Vulnerability Type: Supply-chain risk from an unpinned executable package and mutable remote source
Risk Level: Medium

bash

npx add https://github.com/wpank/ai/tree/main/skills/backend/service-layer-architecture

Technical Analysis

The installation command invokes npx, which can download and execute the third-party add package when it is not already installed locally. No exact package version or integrity hash is specified. The Skill source is also obtained from a personal GitHub repository through the mutable main branch rather than an immutable commit or signed release.

Consequently, the code and installation behavior executed by this command can change after the reviewed project version has been published. Compromise of the npm package, its maintainer account, the GitHub account, or the referenced branch could introduce attacker-controlled installation logic.

Attack Path

1. An attacker compromises the npm package, its publisher account, the GitHub repository, or another relevant distribution component.
2. The attacker publishes malicious installer behavior or modifies content available through the mutable main branch.
3. A user follows the documented installation instructions and runs the npx add ... command.
4. npx retrieves and executes the unpinned package with the user's current privileges.
5. The malicious installer can access files, environment variables, credentials, and network resources available to that user.

Impact Assessment

Successful exploitation could result in arbitrary command execution under the privileges of the user performing the installation. The reachable scope may include project files, user-owned files, development credentials, environment variables, SSH configuration, package registry tokens, and accessible network services. If the command is run from a privileged account or CI/CD enviro ...[truncated 117 chars]

Remediation

View remediation

Remediation Suggestions

• Replace the unversioned npx add invocation with a trusted installer pinned to an exact package version.
• Pin the Skill source to a reviewed, immutable Git commit instead of the mutable main branch.
• Verify downloaded content with a published cryptographic checksum or signature before installation.
• Prefer documented manual installation that downloads reviewed files without executing an intermediary package.
• If an installer is necessary, document its source, exact version, expected integrity value, and required permissions.
• Run installation with least privilege in an isolated environment, and avoid exposing unnecessary credentials or sensitive environment variables.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 34)May include surrounding context.

From your project root:

bash

mkdir -p .cursor/skills
cp -r ~/.ai-skills/skills/backend/service-layer-architecture .cursor/skills/service-layer-architecture

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 50)May include surrounding context.

From your project root:

bash

mkdir -p .claude/skills
cp -r ~/.ai-skills/skills/backend/service-layer-architecture .claude/skills/service-layer-architecture

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 57)May include surrounding context.

Claude Code (global)

bash

mkdir -p ~/.claude/skills
cp -r ~/.ai-skills/skills/backend/service-layer-architecture ~/.claude/skills/service-layer-architecture

External Model or Provider Selection

Medium

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: service-layer-architecture
model: standard
description: Controller-service-query layered API architecture with data enrichment and parallel fetching. Use when building REST APIs or GraphQL resolvers with clean separation of concerns. Triggers on API architecture, service layer, controller pattern, data enrichment, REST API.
---

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest description says the skill 'Triggers on API architecture, service layer, controller pattern, data enrichment, REST API' without defining exact trigger phrases, constraints, or exclusion conditions. Several of these terms are broad technical topics that could appear in ordinary development conversations, making unintended activation more likely.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.