Dessix Skill

• Outcome: Review
• Latest audit: Sep 11, 2026 · 12:36 AM UTC
• Version: 1.1.0

Overview

This skill is for controlling a local Dessix workspace, but it exposes broad read/write bridge access without a clear permission boundary.

Review before installing if you do not want an agent to read or change Dessix workspace content. Use this only with a trusted Dessix desktop app, approve the exact bridge tool and block/workspace IDs before any create, update, or delete operation, and prefer pinned installation commands over mutable npx/global npm examples.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: README.md:7

Finding

Unpinned npm packages are downloaded and executed

Content

View full analysis

Remediation

View remediation

-- skills add dessix-skill ``` 3. Replace the global installation example with an exact version: ```bash npm install --global clawhub@ ``` 4. Prefer project-local, lockfile-controlled tooling over global installation where practical. 5. Document the expected npm registry and package publisher identity. 6. Verify npm package provenance, integrity metadata, release signatures, and ownership before updating the documented version. 7. Review the selected packages and their transitive dependencies for lifecycle scripts before recommending execution. 8. Run installation with the least-privileged user account and avoid elevated shells. ]]>

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (27)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 12)May include surrounding context.

md

Use `scripts/dessix-bridge.mjs` for all requests instead of re-implementing socket logic.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 19)May include surrounding context.

md

Use `scripts/dessix-bridge.mjs` for all requests instead of re-implementing socket logic.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 25)May include surrounding context.

md

Use `scripts/dessix-bridge.mjs` for all requests instead of re-implementing socket logic.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 31)May include surrounding context.

md

Use `scripts/dessix-bridge.mjs` for all requests instead of re-implementing socket logic.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 39)May include surrounding context.

md

Use `scripts/dessix-bridge.mjs` for all requests instead of re-implementing socket logic.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 47)May include surrounding context.

md

Use `scripts/dessix-bridge.mjs` for all requests instead of re-implementing socket logic.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 55)May include surrounding context.

md

Use `scripts/dessix-bridge.mjs` for all requests instead of re-implementing socket logic.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 75)May include surrounding context.

md

Use `scripts/dessix-bridge.mjs` for all requests instead of re-implementing socket logic.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 76)May include surrounding context.

md

Use `scripts/dessix-bridge.mjs` for all requests instead of re-implementing socket logic.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 78)May include surrounding context.

md

Use `scripts/dessix-bridge.mjs` for all requests instead of re-implementing socket logic.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 86)May include surrounding context.

md

Use `scripts/dessix-bridge.mjs` for all requests instead of re-implementing socket logic.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 87)May include surrounding context.

md

Use `scripts/dessix-bridge.mjs` for all requests instead of re-implementing socket logic.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 89)May include surrounding context.

md

Use `scripts/dessix-bridge.mjs` for all requests instead of re-implementing socket logic.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 97)May include surrounding context.

md

Use `scripts/dessix-bridge.mjs` for all requests instead of re-implementing socket logic.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 98)May include surrounding context.

md

Use `scripts/dessix-bridge.mjs` for all requests instead of re-implementing socket logic.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 100)May include surrounding context.

md

Use `scripts/dessix-bridge.mjs` for all requests instead of re-implementing socket logic.

Known Vulnerable Dependency: brace-expansion==5.0.3 — 5 advisory(ies): CVE-2026-13149 (brace-expansion: DoS via exponential-time expansion of consecutive non-expanding); CVE-2026-33750 (brace-expansion: Zero-step sequence causes process hang and memory exhaustion); CVE-2026-45149 (brace-expansion: Large numeric range defeats documented `max` DoS protection) +2 more

High

• Category: Supply Chain
• Confidence: 97% confidence

Finding

brace-expansion 5.0.3 is flagged for multiple denial-of-service issues involving pathological brace patterns and range handling. Even though it appears here as a transitive devDependency via minimatch/eslint, the dependency is genuinely vulnerable and any workflow that processes attacker-controlled glob-like patterns during development or automation could be forced into excessive CPU or memory consumption.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: flatted==3.3.3 — 2 advisory(ies): CVE-2026-32141 (flatted vulnerable to unbounded recursion DoS in parse() revive phase); CVE-2026-33228 (Prototype Pollution via parse() in NodeJS flatted)

High

• Category: Supply Chain
• Confidence: 93% confidence

Finding

flatted 3.3.3 is reported vulnerable to prototype pollution and unbounded recursion DoS in parse() behavior. This is a real issue in the dependency tree, but here it is only transitively included through flat-cache for eslint as a devDependency, so the direct runtime risk to the published skill is lower unless untrusted data is fed into development tooling or local automation that invokes the parser.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The README instructs users to install the skill via npx skills add dessix-skill without pinning a specific package version. Because npx resolves and executes the latest published package by default, a compromised upstream package, malicious update, or namespace takeover could cause users to fetch and run unreviewed code. In this skill's context, that is more dangerous because the package is intended to interface with a local Electron bridge and local workspace data, increasing the value of any supply-chain compromise.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill exposes access to a local Electron bridge and requires environment-based connectivity, but it does not declare any explicit tool scope or permissions boundary. That makes it easier for an agent to invoke sensitive local capabilities without a clear allowlist, increasing the chance of unintended access to workspace data or write-capable bridge tools.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The description is very broad: it invites use whenever an agent needs to read, invoke tools programmatically, build automations, or fetch prompt content. Broad trigger language can cause over-selection of this skill in unrelated contexts, leading agents to access a local desktop bridge and potentially sensitive workspace content more often than necessary.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The multi-step examples include write-capable operations like dessix_create_block and dessix_update_block, but they do not present a strong, explicit warning that these commands modify the user's local workspace. In an agent setting, that omission can normalize destructive or persistent changes without clear consent, especially because the skill targets a local desktop application's data plane.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: @humanfs/node==0.16.7 — 1 advisory(ies): GHSA-p498-v437-472g (humanfs: Recursive copy follows symlinked files and copies data from outside the)

Low

• Category: Supply Chain
• Confidence: 89% confidence

Finding

The lockfile pins @humanfs/node 0.16.7, which is reported vulnerable to recursive copy following symlinks and copying files from outside the intended tree. This is a real supply-chain risk, but in this specific skill the package is only a transitive devDependency of eslint and there is no evidence from this file that the vulnerable copy functionality is exercised at runtime by the skill itself, which reduces practical exposure.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 17)May include surrounding context.

json

"clawhub:sync": "clawhub sync --root . --bump patch --tags latest"
  },
  "devDependencies": {
    "@eslint/js": "^10.0.1",
    "eslint": "^10.0.2",
    "globals": "^17.3.0",
    "prettier": "^3.8.1"

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 18)May include surrounding context.

json

},
  "devDependencies": {
    "@eslint/js": "^10.0.1",
    "eslint": "^10.0.2",
    "globals": "^17.3.0",
    "prettier": "^3.8.1"
  }

Static analysis

No suspicious patterns detected.