Intent Framed Agent

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 5:54 AM UTC
• Version: 1.0.0

Overview

This skill is a lightweight coding-session scoping aid; its main risks are unpinned install commands and a low-impact local CLI check, not hidden harmful behavior.

Install this only if you want the agent to pause and create explicit intent frames before non-trivial coding work. Prefer pinned or reviewed install commands, and be aware the skill may check for the Entire CLI locally when it activates.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:10

Finding

Unpinned Third-Party Installation Through npx

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 10–16
Vulnerability Type: Unpinned third-party dependency installation
Risk Level: Medium

Vulnerable Code

bash

npx skills add pskoett/pskoett-ai-skills

bash

npx skills add pskoett/pskoett-ai-skills/intent-framed-agent

Technical Analysis

The installation instructions invoke the third-party skills npm CLI through npx without specifying an exact package version. They also identify external GitHub-hosted skill content without pinning it to an immutable commit hash or verified release.

Consequently, the components executed or installed when a user follows these instructions may differ from those present when this audit was performed. This creates a supply-chain trust gap: compromise of the npm package, its maintainer account, the external repository, or its maintainer credentials could cause later installations to execute malicious package lifecycle behavior or install malicious skill instructions.

The audited file does not demonstrate that either upstream component is currently malicious. The finding concerns the unsafe use of mutable, unverified dependencies.

Attack Path

1. An attacker compromises the referenced npm package, its publishing credentials, the external repository, or a relevant maintainer account.
2. The attacker publishes a malicious version of the CLI or modifies the repository content resolved by the installation command.
3. A user follows the documented command without an explicit version or immutable revision.
4. npx resolves and executes the mutable third-party CLI.
5. The CLI retrieves or installs the attacker-controlled repository content.
6. Malicious installation-time code may run with the invoking user's privileges, or malicious skill instructions may subsequently influence agent sessions.

Impact Assessment

Successful exploitation could execute code with the privileges of the user running npx. Depending on that user's envir ...[truncated 497 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the skills npm CLI to an exact, reviewed version, rather than allowing npx to resolve a mutable release.
• Pin the external repository dependency to a reviewed commit hash or cryptographically verified, immutable release.
• Provide expected integrity hashes or signed provenance for downloaded artifacts.
• Avoid automatic execution of newly downloaded packages where practical; separate retrieval, review, and execution.
• Recommend inspecting downloaded skill files and scripts before activation.
• Use lockfiles and trusted registries where supported, and enable dependency provenance or signature verification.
• Periodically review pinned versions for disclosed vulnerabilities and update them through a controlled security-review process.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger cues include generic phrases like 'go ahead' and 'let's start building', which are common in normal conversation and may cause the skill to activate outside the user's intended scope. In an agent system, unintended activation can alter workflow, insert gating steps, or influence subsequent tool use and code changes, creating scope-control and consent issues.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill instructs the agent to run entire status 2>/dev/null when tool access is available, but it does not require explicit user notice or consent before local command execution. Even though the command appears low impact, silent environment probing violates least surprise and establishes a risky pattern where skills perform undisclosed local checks on the user's system.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.