Grilling

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 9:51 AM UTC
• Version: 1.0.6

Overview

This is a small planning-interview skill with transparent behavior, but its README installation examples should be treated cautiously because they fetch mutable or unpinned installer content.

Review the skill text before installing. Prefer installing from a pinned release or commit and avoid unpinned npx or raw main-branch curl commands unless you trust the repository and installer source.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: README.md:27

Finding

Unpinned executable npm installer dependency

Content

View full analysis

Vulnerability Details

File Location: README.md, lines 27-36
Vulnerability Type: Unpinned executable third-party dependency
Risk Level: Medium

Vulnerable Code

bash

npx skills add wufei-png/grilling -g -y --agent codex

bash

npx skills add wufei-png/grilling --skill grilling -g -y --agent codex

Technical Analysis

The documented installation commands invoke the skills npm package through npx without specifying an audited package version or integrity constraint. If the package is absent locally, npx can retrieve and execute it from the configured npm registry.

Consequently, the code executed by these commands can change independently of the reviewed repository. The -y option suppresses interactive confirmation, while -g requests a global installation, increasing the potential effect of a compromised installer. Exploitation requires compromise or malicious control of the package, its publication credentials, the package-resolution path, or the configured registry.

Attack Path

1. An attacker compromises the skills package, its maintainer account, or an npm registry used by the victim.
2. The attacker publishes or serves a malicious package version.
3. A user follows the README and runs the unpinned npx skills add command.
4. npx downloads and executes the attacker-controlled package without a version constraint.
5. The malicious installer runs with the invoking user's privileges and can alter files available to that user, including globally installed agent skills or configuration.
6. Modified agent instructions may subsequently influence sessions that load the installed skill.

Impact Assessment

Successful exploitation could execute arbitrary code with the privileges of the user running the command. The attacker could modify user-accessible files, agent configuration, and globally installed skill content; access data available to that account; or install additional malicious components. The comma ...[truncated 150 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the installer to a specific, reviewed version, for example by invoking npx skills@<audited-version>.
• Lock and verify the package using npm integrity metadata or a separately published cryptographic checksum.
• Document the expected package publisher, version, and checksum so users can validate the artifact before execution.
• Avoid -y in the default installation example so users can review package-resolution information before execution.
• Avoid global installation by default. Prefer a scoped, user-controlled destination with the minimum required permissions.
• For higher-assurance installation, download the pinned package artifact, verify its digest, inspect it, and only then execute it.
• Establish a release process that updates the documented version and checksum only after security review.

T08 · Insecure Dependencies

Warning

• Location: README.md:41

Finding

Mutable remote skill instructions installed without integrity verification

Content

View full analysis

Vulnerability Details

File Location: README.md, lines 41-56
Vulnerability Type: Unverified installation from a mutable remote source
Risk Level: Medium

Vulnerable Code

bash

mkdir -p "${CODEX_HOME:-$HOME/.codex}/skills/grilling"
curl -fsSL \
  https://raw.githubusercontent.com/wufei-png/grilling/main/SKILL.md \
  -o "${CODEX_HOME:-$HOME/.codex}/skills/grilling/SKILL.md"

bash

mkdir -p "$HOME/.agents/skills/grilling"
curl -fsSL \
  https://raw.githubusercontent.com/wufei-png/grilling/main/SKILL.md \
  -o "$HOME/.agents/skills/grilling/SKILL.md"

Technical Analysis

Both installation procedures retrieve SKILL.md from the mutable main branch and write it directly into directories from which agent systems may load trusted instructions. The commands neither pin the download to the reviewed commit nor verify a cryptographic digest or signature.

TLS protects the network connection but does not ensure that the content on the mutable branch remains identical to the version audited here. A repository compromise, maintainer-account compromise, or later malicious modification could therefore replace the reviewed skill instructions with attacker-controlled content. The installed instructions would persist in the user's skill directory until removed or replaced.

The audited local SKILL.md does not itself contain confirmed malicious behavior; the risk arises from the installation method allowing future remote content to differ from the audited artifact.

Attack Path

1. An attacker compromises the GitHub repository or an account authorized to modify its main branch.
2. The attacker replaces SKILL.md with instructions designed to redirect agent behavior, misuse tools, disclose accessible data, or weaken safety constraints.
3. A user executes one of the documented curl installation commands.
4. The command downloads the current attacker-controlled file without validating a commit identifier, signature, or checksum.
5. T ...[truncated 943 chars]

Remediation

View remediation

Remediation Suggestions

• Replace the mutable main URL with an immutable URL containing a reviewed full commit SHA.
• Publish the expected SHA-256 digest for every released SKILL.md and verify it before moving the file into a trusted skill directory.
• Download to a temporary file first, verify its digest or signature, and perform an atomic rename only after validation succeeds.
• Prefer signed release artifacts or repository releases with verifiable provenance instead of raw branch content.
• Present the downloaded instructions for review before installation, particularly when they will be loaded automatically by an agent.
• Document a safe update procedure that requires the new commit and digest to undergo review rather than silently tracking a branch.
• Restrict permissions on installed skill files and their parent directories so other local users cannot modify them.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (7)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence

Finding

The README instructs users to run npx skills add ... without pinning an exact package version or integrity. npx fetches and executes the current package version at install time, so a compromised upstream package, dependency, or future malicious release could lead to arbitrary code execution on the user's machine.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence

Finding

This is the same unpinned npx skills add pattern, just in the variant that selects a specific skill. Because the package version is not fixed, users may execute unintended code if the package or one of its dependencies changes or is hijacked.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 83% confidence

Finding

The README instructs users to persistently install remotely fetched content directly into the agent's user skill directory using curl ... -o .../SKILL.md without version pinning, commit pinning, or integrity verification. Because the file is placed in a persistent location that the agent may later load automatically, a compromised repository, branch, or network path could create durable malicious behavior across future sessions.

Content

Scanner excerpt · README.md (reported line 43)May include surrounding context.

Install the source SKILL.md into Codex's user skill directory:

bash

mkdir -p "${CODEX_HOME:-$HOME/.codex}/skills/grilling"
curl -fsSL \
  https://raw.githubusercontent.com/wufei-png/grilling/main/SKILL.md \
  -o "${CODEX_HOME:-$HOME/.codex}/skills/grilling/SKILL.md"

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 46)May include surrounding context.

mkdir -p "${CODEX_HOME:-$HOME/.codex}/skills/grilling" curl -fsSL
https://raw.githubusercontent.com/wufei-png/grilling/main/SKILL.md
-o "${CODEX_HOME:-$HOME/.codex}/skills/grilling/SKILL.md"

text

For agent setups that read from `~/.agents/skills`, use:

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 55)May include surrounding context.

mkdir -p "${CODEX_HOME:-$HOME/.codex}/skills/grilling" curl -fsSL
https://raw.githubusercontent.com/wufei-png/grilling/main/SKILL.md
-o "${CODEX_HOME:-$HOME/.codex}/skills/grilling/SKILL.md"

text

For agent setups that read from `~/.agents/skills`, use:

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger condition is ambiguous because it activates on unspecified 'grill' trigger phrases, which can cause the skill to be invoked unexpectedly in unrelated contexts. In a conversational agent, overly broad routing can lead to inappropriate behavior, user confusion, or the skill taking over interactions where a different safety or domain-specific workflow should apply.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.