NVS Node.js Version Manager

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:19 AM UTC
• Version: 1.0.0

Overview

This NVS helper skill is mostly purpose-aligned, but its installer can fetch and immediately run unpinned remote shell code without adequate warning or validation.

Review the installer before use. Prefer installing NVS through a trusted package manager or a pinned, verified release, and only run the bundled install script if you accept that it can execute current code from the upstream NVS repository and alter your shell configuration. Confirm before enabling auto-switching or setting persistent defaults.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: scripts/install_nvs.sh:42

Finding

Unpinned Remote Repository Content Is Immediately Executed

Content

View full analysis

Remediation

View remediation

" git clone --no-checkout "$NVS_REPOSITORY" "$NVS_HOME" git -C "$NVS_HOME" fetch --depth 1 origin "$NVS_COMMIT" git -C "$NVS_HOME" checkout --detach "$NVS_COMMIT" test "$(git -C "$NVS_HOME" rev-parse HEAD)" = "$NVS_COMMIT" || { echo "NVS commit verification failed" >&2 exit 1 } . "$NVS_HOME/nvs.sh" install ``` ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/install_nvs.sh:42

Finding

Unvalidated Existing NVS Directory Can Supply the Executed Installer

Content

View full analysis

Remediation

View remediation

/dev/null ``` 3. Verify that the configured remote exactly matches the expected canonical repository. 4. Fetch and check out a pinned commit rather than running an unrestricted `git pull`. 5. Verify that the final `HEAD` commit matches the approved commit before sourcing any file. 6. Check that `NVS_HOME` and `nvs.sh` are owned by the expected user and are not writable by untrusted users. 7. Reject symbolic links or resolve the canonical path and confirm that it remains within the expected user-owned location. 8. Exit immediately if any validation, update, ownership, or integrity check fails. 9. For unexpected existing directories, stop and require explicit user confirmation rather than executing their contents. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (14)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The skill claims to manage Node.js versions with NVS, but it also instructs the agent/user to install NVS itself via package managers or by cloning and sourcing a remote GitHub repository. That expands behavior from version management into tool bootstrap, network access, and shell/environment modification, which creates additional supply-chain and persistence risk not clearly called out in the skill purpose.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill claims to manage Node.js versions with NVS, but it also instructs the agent/user to install NVS itself via package managers or by cloning and sourcing a remote GitHub repository. That expands behavior from version management into tool bootstrap, network access, and shell/environment modification, which creates additional supply-chain and persistence risk not clearly called out in the skill purpose.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The document directly instructs users to run an automatic installation script but does not warn that it will modify the system, install software, and potentially alter shell configuration. That omission is risky because users may execute the script without informed consent, especially when the skill is framed as turnkey and ready to use.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The activation conditions are broad enough to trigger on almost any Node.js version-management discussion, which can cause unintended invocation of the skill and increase the chance that users are guided into running environment-changing commands without explicit intent. In this context, the skill is operational and recommends installation and version-switching actions, so overbroad triggering materially raises the risk of inappropriate or surprising system changes.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · EXAMPLES.md (reported line 91)May include surrounding context.

Using Aliases

bash

# Create meaningful aliases for your projects
nvs alias project-a 16.20.0
nvs alias project-b 18.20.0
nvs alias latest-lts lts

File System Enumeration

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.

Content

Scanner excerpt · EXAMPLES.md (reported line 202)May include surrounding context.

md

# Issue: Permission denied on Mac/Linux
# Solution: Check NVS_HOME directory permissions
ls -la ~/.nvs
chmod -R u+w ~/.nvs

# Issue: Wrong version showing after switch

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The README states that the skill automatically activates for broad triggers such as general Node.js version management, switching versions, project setup, and compatibility issues. This can cause the agent to invoke this skill in situations where the user did not specifically request NVS, leading to inappropriate guidance or execution of helper scripts in unrelated support flows. In this context the issue is less dangerous than a code-execution flaw, but it still increases the chance of unintended tool use and user-environment changes.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · REFERENCE.md (reported line 112)May include surrounding context.

Examples:

bash

nvs alias myapp 18.20.0    # Create alias
nvs alias                  # List all aliases
nvs alias myapp            # Remove alias
nvs run myapp --version    # Use alias

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The activation text is broad enough to trigger on generic mentions of Node.js version management or environment changes, increasing the chance the skill is invoked in contexts where the user did not specifically request NVS. Over-broad routing can lead to unnecessary execution of state-changing commands, especially installs or version switches in the current shell.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

Commands like nvs link, nvs auto on, alias creation, and installation steps can persistently change defaults and environment behavior, but the documentation does not warn users that these effects outlive the current session. In an agent context, missing warnings increase the risk of surprising long-lived modifications to developer environments.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 107)May include surrounding context.

Version aliases

bash

# Create an alias
nvs alias myproject 18.20.0

# List all aliases

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

SQP-3 applies to all file types and includes language or locale policy violations. This file presents the skill entirely in Chinese while describing general-purpose usage, but does not indicate that language selection is user-configurable or that Chinese is a justified region-specific requirement.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

This markdown file documents nvs rm <version>, which removes installed Node.js versions, but does not include any warning that the action deletes local tool installations. Under the markdown-file criteria for missing user warnings, destructive behavior that could affect user data or system state should be disclosed.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 75% confidence

Finding

The nvs auto section explains automatic version switching based on .node-version or .nvmrc files, but it does not warn that entering a directory can change the active runtime automatically. For markdown descriptions, behaviors that affect system integrity or execution context should be clearly disclosed to users.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.