The Agent Skills Directory

[COMMAND_EXECUTION]: Several helper scripts within the skill interpolate package names directly into shell strings for execution. Specifically, execSync('npm view ' + name + ' --json ...') in Step 2 and Step 5, and similar logic in Step 6. If a package.json file contains a malicious package name (e.g., using shell metacharacters like ; or &), it could lead to arbitrary command execution when the agent runs these audit steps.
[EXTERNAL_DOWNLOADS]: The skill fetches package metadata and download statistics from api.npmjs.org and the NPM registry. While these are well-known services, the skill uses a pattern of piping the output of curl directly into node -e to parse the resulting JSON.
[DYNAMIC_EXECUTION]: The skill extensively uses node -e to execute inline JavaScript snippets. These snippets are used to parse local files, handle JSON data from tool outputs, and spawn further subprocesses via execSync using dynamically constructed command strings.
[INDIRECT_PROMPT_INJECTION]: The skill represents an attack surface for indirect prompt injection because it ingests untrusted data from package.json (Step 1) and tool outputs (Step 3). This data is then used to drive high-privilege actions including Shell (to run updates and builds) and Write (to modify the project files) without explicit boundary markers or sanitization of the interpolated content.

dependencies-audit