Find Skills

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:29 AM UTC
• Version: 1.0.0

Overview

The skill is coherent but asks agents to run unpinned package-manager commands and install skills globally without confirmation, which needs user review.

Review this carefully before installing. Prefer using a locally installed or version-pinned Skills CLI, inspect any skill source before installation, avoid `-g -y` unless you deliberately want user-wide installation with no prompt, and do not let the agent update all installed skills without reviewing what will change.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:23

Finding

Unpinned Third-Party CLI Enables Unsafe Supply-Chain Execution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:23-29
Vulnerability Type: Unpinned third-party package execution
Risk Level: Medium

Complete Code Snippet:

markdown

**Key commands:**

- `npx skills find [query]` - Search for skills interactively or by keyword
- `npx skills add <package>` - Install a skill from GitHub or other sources
- `npx skills check` - Check for skill updates
- `npx skills update` - Update all installed skills

Technical Analysis

The skill directs the agent to invoke the skills package through npx without specifying an immutable package version or verifying package integrity. If the package is not already present in the local cache, npx may retrieve it from the configured npm registry and execute it. Consequently, the code executed at invocation time can differ from the code that existed when this skill was audited.

The documented add and update operations also accept mutable content from GitHub or unspecified “other sources.” Popularity indicators such as install counts and GitHub stars do not provide cryptographic integrity, source authenticity, or protection against a legitimate upstream account being compromised.

Attack Path

1. An attacker compromises the upstream skills npm package, its publisher account, a configured package registry, or a skill source accepted by the CLI.
2. The attacker publishes a malicious version or replaces mutable upstream skill content.
3. A user asks the agent to discover, install, or update a skill.
4. Following SKILL.md, the agent executes an unversioned npx skills command.
5. npx retrieves and runs the current upstream package, or the CLI retrieves the compromised skill.
6. Attacker-controlled installation logic or skill instructions execute within the permissions of the invoking user.

Impact Assessment

Exploitation could obtain the privileges of the user running the agent or CLI. Depending on the be ...[truncated 391 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the CLI to an explicitly reviewed version, such as npx skills@<approved-version>, rather than resolving the latest mutable release.
2. Lock installed skills to immutable release identifiers or reviewed commit hashes.
3. Restrict installation sources to an explicit allowlist of trusted repositories and owners; remove support for unspecified sources.
4. Verify package integrity, provenance, and signatures where the ecosystem supports them.
5. Download and inspect skill contents before installation, including scripts, hooks, dependencies, and instruction files.
6. Separate search from installation so discovery never implicitly authorizes execution.
7. Require explicit user approval for every installation and update.
8. Run package discovery and inspection in a sandbox with minimal filesystem, credential, and network access.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:91

Finding

Global Skill Installation Suppresses User Confirmation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:91-96
Vulnerability Type: Unsafe global installation configuration
Risk Level: Medium

Complete Code Snippet:

markdown

If the user wants to proceed, you can install the skill for them:

```bash
npx skills add <owner/repo@skill> -g -y

The -g flag installs globally (user-level) and -y skips confirmation prompts.

text

### Technical Analysis

The recommended installation command combines user-level global installation (`-g`) with automatic confirmation (`-y`). This broadens the installed skill's scope beyond the current project and removes a final interactive checkpoint at which the resolved source and requested changes could be reviewed.

Although the text conditions installation on the user wanting to proceed, the command itself does not require confirmation after package resolution. A compromised, deceptive, or incorrectly selected skill can therefore be installed into shared user-level agent state without presenting the final resolved artifact for approval. This is a least-privilege and supply-chain hardening weakness rather than evidence that this package itself contains malicious code.

### Attack Path

1. An attacker publishes a deceptive skill, compromises a legitimate skill repository, or causes a malicious source to appear trustworthy.
2. The skill is returned by discovery and passes superficial reputation checks, or the source changes after those checks.
3. The agent runs `npx skills add <owner/repo@skill> -g -y`.
4. The `-y` option suppresses the installation confirmation, preventing review of the final resolved source.
5. The `-g` option places attacker-controlled skill content in user-level shared scope.
6. The installed content may be available to later projects or agent sessions and can influence subsequent actions when loaded.

### Impact Assessment

The immediate scope is the invoking user's global skill environm
...[truncated 426 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove -y and require an interactive confirmation displaying the exact resolved owner, repository, skill, version, and destination.
2. Remove -g by default and install into a project-local, isolated directory.
3. Require separate, explicit consent before any global installation.
4. Pin the selected skill to an immutable reviewed commit or signed release.
5. Present the user with a manifest of files, scripts, hooks, dependencies, and requested capabilities before installation.
6. Apply an allowlist for trusted owners and repositories and verify repository identity cryptographically where possible.
7. Provide a removal command and maintain an installation record to support auditing and rollback.
8. Load installed skills with least privilege and isolate them from unrelated projects, credentials, and persistent agent state.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (15)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger guidance includes broad phrases like 'how do I do X' and 'can you do X', which are common in normal conversation and can cause this skill to activate unexpectedly. In this skill's context, unintended activation is more dangerous because activation may lead the agent to execute external package-manager commands and suggest or perform installations from third-party sources.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The skill repeatedly instructs use of npx skills without pinning a package version, which causes execution of whatever package version is current at invocation time. Because this skill is specifically about discovering and installing additional code from external sources, an upstream compromise, typosquat, or malicious update could lead to arbitrary code execution in the user's environment.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The unpinned npx skills add <package> pattern executes a remote package manager entrypoint whose contents may change over time. In this skill's context, it directly facilitates installing third-party skills from GitHub or other sources, expanding the attack surface and making supply-chain compromise materially dangerous.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

Using npx skills check without a pinned version still executes mutable remote code, even though the command appears read-only. A compromised or substituted package could run arbitrary code during the check operation, so the apparent harmlessness of the verb does not eliminate the supply-chain risk.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

The npx skills update command is presented without version pinning, which combines execution of mutable remote code with modification of installed skills. If the package or its dependency chain is compromised, this can propagate malicious updates broadly across the environment.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The skill tells the agent to run npx skills find [query] without pinning the CLI version. Even for search functionality, this executes mutable third-party code in response to ordinary user requests, so a compromised package can convert benign discovery into arbitrary code execution.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence

Finding

This example encourages an unpinned npx skills find react performance execution. Because examples are likely to be copied verbatim, they normalize unsafe remote execution and can expose the environment to supply-chain attacks even when the user only intended to search.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence

Finding

The unpinned example command for PR review searches still executes mutable remote code. In a skill intended for broad natural-language triggering, this increases the chance that routine conversations lead to unsafe command execution under the guise of a simple lookup.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence

Finding

This example again uses unpinned npx skills find, creating the same remote-code-execution exposure through supply-chain drift or compromise. The risk is amplified because the skill is designed to be routinely invoked when users ask for help finding capabilities.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The installation example npx skills add ... is especially risky because it combines unpinned execution of the package manager with installation of a third-party skill. That creates a two-layer supply-chain problem: compromise of the CLI itself or compromise of the fetched skill source.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill recommends -g -y for installation, enabling global changes and suppressing confirmation prompts without adequately warning about system impact. In a discovery/install skill, that creates a realistic path to silent persistence and broad environment modification if a malicious or mistaken package is installed.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The command npx skills add <owner/repo@skill> -g -y is unpinned and additionally installs globally with no confirmation, magnifying the effect of any compromise. This can lead to silent system-wide changes and persistent execution of untrusted code from external repositories.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence

Finding

The suggestion to use npx skills init without pinning still invokes mutable remote code, though the command's apparent purpose is local scaffolding. A compromised package could execute arbitrary actions instead of or in addition to initialization.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence

Finding

This line again references npx skills in a way that encourages unpinned execution of third-party tooling. Repetition throughout the skill normalizes unsafe package-manager usage and raises the likelihood of operators adopting it without scrutiny.

Content

No source excerpt is available for this finding.