docsiphon Doc Corpus Operator

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:53 AM UTC
• Version: 1.0.0

Overview

The skill is coherent, but its install and demo path runs mutable GitHub code without pinning a reviewed version.

Install only if you are comfortable running code from the current state of the referenced GitHub repository. Prefer a pinned commit or verified release, review the Docsiphon source and dependencies, and run it in a low-privilege or disposable environment with only the intended output directory writable.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Warning

• Location: references/INSTALL.md:7

Finding

Unpinned Remote Git Repository Is Retrieved and Executed

Content

View full analysis

Vulnerability Details

File Locations: references/INSTALL.md:7-12, references/DEMO.md:3-11
Vulnerability Type: T03: Remote Payload Retrieval and Execution
Risk Level: Medium

Vulnerable Code

references/INSTALL.md:7-12:

bash

1. install `uv`
2. run Docsiphon directly from GitHub with `uvx`

```bash
uvx --from git+https://github.com/xiaojiou176-open/docsiphon.git \
  docsiphon --help

references/DEMO.md:3-11:

bash

Use this exact first-success path before trying bigger targets:

```bash
uvx --from git+https://github.com/xiaojiou176-open/docsiphon.git \
  docsiphon "https://developerdocs.instructure.com/services/canvas" \
  --scope-prefix /services/canvas \
  --max-pages 6 \
  --out ./_outputs \
  --site-root auto

Technical Analysis

The documented installation and demonstration commands direct uvx to retrieve a Git repository and execute its Docsiphon entry point. The repository URL is not pinned to an immutable, reviewed commit SHA or a verified release artifact. Its effective payload can consequently change after this skill package has been reviewed without requiring any modification to the audited files.

If the repository, its default branch, its dependency configuration, or its maintainer account is compromised, a subsequent invocation can retrieve and execute attacker-controlled Python code. Merely running docsiphon --help does not eliminate this risk because package installation, dependency resolution, module loading, and CLI initialization can all execute code before help output is displayed.

The remote Docsiphon implementation and its transitive dependencies are not included in this project, so their behavior could not be statically audited here.

Attack Path

1. An attacker compromises the referenced GitHub repository, a maintainer account, or a dependency resolved by the remote project.
2. The attacker adds malicious code to the repository ...[truncated 1234 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the Git source to a reviewed full commit SHA rather than the mutable default branch, for example:

   bash

   uvx --from "git+https://github.com/xiaojiou176-open/docsiphon.git@FULL_COMMIT_SHA" \
     docsiphon --help
   

2. Prefer a trusted package-registry release with an exact version and cryptographic hash verification when such a distribution is available.

3. Lock and verify transitive dependencies so that dependency resolution cannot silently introduce newly published or compromised components.

4. Document the expected repository revision, release provenance, and integrity values in both installation and demonstration instructions.

5. Execute the tool in a sandbox or disposable environment with:

   • No unnecessary credentials or secrets.
   • Read-only access to unrelated project files.
   • Write access restricted to the intended output directory.
   • Restricted outbound network access limited to required documentation targets.
   • No administrative or root privileges.

6. Review the pinned remote source and dependency lock data before updating the documented revision. Require a new security review whenever that pin changes.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The manifest lists generic trigger terms such as docsiphon, sitemap, llms.txt, manifest.jsonl, and report.html without narrowing context or specifying when the skill should or should not activate. Several of these are common artifact names or broad product mentions, which can cause unintended invocation overlap with ordinary discussion or unrelated tasks.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The demo instructs users to execute code fetched directly from a Git repository via uvx --from git+https://... without pinning to a specific commit, tag, or immutable version. This creates a supply-chain risk: repository contents can change over time or be compromised, causing future runs of the documented command to execute unexpected or malicious code on the user's system.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The install instructions tell users to execute code directly from a GitHub repository using uvx --from git+https://... without pinning to a specific commit, tag, or verified release. This creates a supply-chain risk: if the repository is compromised or the referenced branch changes, users may run unexpected code at install time with no integrity guarantee.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.