Service Layer Architecture

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 4:32 PM UTC
• Version: 1.0.0

Overview

This is a straightforward architecture guidance skill, with no hidden runtime behavior, though its README installation command should be treated cautiously because it is unpinned.

Before installing, prefer a pinned release or reviewed commit instead of the README's unpinned npx command from main. The skill content itself is documentation-style architecture guidance and does not show hidden execution, credential access, data exfiltration, or destructive behavior.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: README.md:23
• Finding: Unpinned Third-Party Installer Execution## Vulnerability Details **File Location**: `README.md`, lines 23-25 **Vulnerability Type**: Supply-chain risk from an unpinned executable package and mutable remote source **Risk Level**: Medium ```bash npx add https://github.com/wpank/ai/tree/main/skills/backend/service-layer-architecture ``` ### Technical Analysis The installation command invokes `npx`, which can download and execute the third-party `add` package when it is not already installed locally. No exact package version or integrity hash is specified. The Skill source is also obtained from a personal GitHub repository through the mutable `main` branch rather than an immutable commit or signed release. Consequently, the code and installation behavior executed by this command can change after the reviewed project version has been published. Compromise of the npm package, its maintainer account, the GitHub account, or the referenced branch could introduce attacker-controlled installation logic. ### Attack Path 1. An attacker compromises the npm package, its publisher account, the GitHub repository, or another relevant distribution component. 2. The attacker publishes malicious installer behavior or modifies content available through the mutable `main` branch. 3. A user follows the documented installation instructions and runs the `npx add ...` command. 4. `npx` retrieves and executes the unpinned package with the user's current privileges. 5. The malicious installer can access files, environment variables, credentials, and network resources available to that user. ### Impact Assessment Successful exploitation could result in arbitrary command execution under the privileges of the user performing the installation. The reachable scope may include project files, user-owned files, development credentials, environment variables, SSH configuration, package registry tokens, and accessible network services. If the command is run from a privileged account or CI/CD enviro ...[truncated 117 chars]
• Remediation: ## Remediation Suggestions - Replace the unversioned `npx add` invocation with a trusted installer pinned to an exact package version. - Pin the Skill source to a reviewed, immutable Git commit instead of the mutable `main` branch. - Verify downloaded content with a published cryptographic checksum or signature before installation. - Prefer documented manual installation that downloads reviewed files without executing an intermediary package. - If an installer is necessary, document its source, exact version, expected integrity value, and required permissions. - Run installation with least privilege in an isolated environment, and avoid exposing unnecessary credentials or sensitive environment variables.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Session Persistence

Medium

• Category: Rogue Agent

Content

From your project root:

```bash
mkdir -p .cursor/skills
cp -r ~/.ai-skills/skills/backend/service-layer-architecture .cursor/skills/service-layer-architecture
```

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

From your project root:

```bash
mkdir -p .claude/skills
cp -r ~/.ai-skills/skills/backend/service-layer-architecture .claude/skills/service-layer-architecture
```

• Confidence: 85% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

#### Claude Code (global)

```bash
mkdir -p ~/.claude/skills
cp -r ~/.ai-skills/skills/backend/service-layer-architecture ~/.claude/skills/service-layer-architecture
```

• Confidence: 85% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

External Model or Provider Selection

Medium

• Category: Excessive Agency

Content

---
name: service-layer-architecture
model: standard
description: Controller-service-query layered API architecture with data enrichment and parallel fetching. Use when building REST APIs or GraphQL resolvers with clean separation of concerns. Triggers on API architecture, service layer, controller pattern, data enrichment, REST API.
---

• Confidence: 90% confidence
• Finding: Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The manifest description says the skill 'Triggers on API architecture, service layer, controller pattern, data enrichment, REST API' without defining exact trigger phrases, constraints, or exclusion conditions. Several of these terms are broad technical topics that could appear in ordinary development conversations, making unintended activation more likely.

Static analysis

No suspicious patterns detected.