Versioned security assessment

Report ID: SA-E5F4474E

7/7/2026, 4:54:39 AM

npm-git-install security assessment v4

Skill Security Certification Report

Audit History
Audit model: codex Historical report
Skill name
npm-git-install
Version
v4
Maintainer
supercent-io
Source
github.com/supercent-io/skills-template/tree/main/.agent-skills/npm-git-install/
Coverage
2 Files scanned · 388 Lines analyzed
Policy version
Unavailable

Highest confirmed finding severity

High

5 confirmed security findings require attention.

Installation context

Historical evidence

This report may not describe the currently installable artifact. Open the current Skill page for install guidance.

Open current Skill page

This report does not block or authorize the manifest or ZIP.

Most static findings are Markdown syntax, placeholder paths, or documentation links rather than executable code. Confirmed risks remain around privileged commands, token handling, npmrc configuration, authenticated Git installs, mutable remote packages, and persistent shell or credential configuration. No prompt injection attempt was found in the reviewed skill text.

Report position

Historical report

Open audit history before using this report to install.

Audit attestation

Not attestable

The required immutable binding is incomplete.

Human verification

Not verified

No human verification is recorded for this report.

Coverage

2 Files scanned · 388 Lines analyzed

25 items shown for review

Limitations

This report does not claim runtime or sandbox execution and does not prove the absence of side effects.

Evidence chain

Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.

  1. Source

    Binding unavailable

  2. Artifact

    Identity incomplete

  3. Audit

    Complete

  4. Install contract

    Open manifest to verify

    Open manifest

Capabilities observed

Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.

Contains scripts

May execute code included with the Skill.

Not recorded by this audit

Network access

May connect to external services.

Observed in 23 evidence locations

Filesystem access

May read or write local files.

Observed in 12 evidence locations

Env variables

May read values from the process environment.

Observed in 3 evidence locations

External commands

May invoke commands or programs outside the Skill.

Observed in 52 evidence locations

Capability review items (20)
High
SKILL.md:196
Shell command substitution
sudo chown -R $(whoami) /usr/local/lib/node_modules
The command substitution is embedded in a sudo chown command that changes ownership under /usr/local. The whoami input is fixed, but the privileged filesystem change is real operational risk.
High
SKILL.md:196
sudo privilege escalation
sudo chown -R $(whoami) /usr/local/lib/node_modules
The guide recommends sudo chown against a global Node.js directory. This can alter system package ownership and should require explicit user approval.
High
SKILL.md:212
sudo privilege escalation
sudo apt-get install git
The guide recommends sudo apt-get install git, which invokes a privileged package manager operation. It is common administration, but still changes the host system.
High
SKILL.md:174
Hardcoded URL
npm install git+https://<token>@github.com/owner/private-repo.git
The install URL places an authentication token directly in the URL. Token-bearing URLs can leak through shell history, process listings, lockfiles, or logs.
High
SKILL.md:178
Hardcoded URL
npm install git+https://${GITHUB_TOKEN}@github.com/owner/private-repo.git
The command expands GITHUB_TOKEN into a Git URL. Even when sourced from an environment variable, the final URL can leak through logs or process metadata.
High
SKILL.md:184
Hidden file in home directory
# ~/.npmrc
The guide introduces ~/.npmrc for token configuration. That hidden home file often stores authentication material and should be handled carefully.
High
SKILL.md:201
Hidden file in home directory
echo 'export PATH=~/.npm-global/bin:$PATH' >> ~/.bashrc
The command appends a PATH export to ~/.bashrc, creating a persistent shell startup change. Persistent shell configuration edits require explicit consent.
High
SKILL.md:184
Hidden file access
# ~/.npmrc
The ~/.npmrc example is tied to GitHub token authentication. Accessing or editing this file can affect package credentials for the user account.
High
SKILL.md:177
Git platform tokens
export GITHUB_TOKEN=ghp_xxxxxxxxxxxx
The guide instructs users to export a GitHub token into the environment. Real tokens are high-value credentials and can leak to child processes.
High
SKILL.md:178
Git platform tokens
npm install git+https://${GITHUB_TOKEN}@github.com/owner/private-repo.git
The install command expands GITHUB_TOKEN into a network URL. That can expose the token in command history, logs, or process metadata.
High
SKILL.md:185
Git platform tokens
//github.com/:_authToken=${GITHUB_TOKEN}
The npmrc example configures GitHub authentication using GITHUB_TOKEN. Misconfigured npmrc files can persist or disclose package access credentials.
Medium
SKILL.md:36
Hardcoded URL
npm install -g git+https://github.com/JEO-tech-ai/supercode.git#main
This installs a hardcoded external GitHub repository from the mutable main branch. Git-based npm installs can execute package lifecycle scripts from remote code.
Medium
SKILL.md:57
Hardcoded URL
npm install -g git+https://github.com/JEO-tech-ai/supercode.git#main --verbose
This repeats the hardcoded external repository install with verbose output. It fetches remote package code and may expose installation details in logs.
Medium
SKILL.md:129
Hardcoded URL
"supercode": "git+https://github.com/JEO-tech-ai/supercode.git#main",
The dependency example pins a package name to a hardcoded external GitHub repository on main. That creates supply-chain exposure if copied into package.json.
Medium
SKILL.md:237
Hardcoded URL
npm install git+https://... --verbose 2>&1 | tee npm-install.log
The verbose install command writes output to a log file. If used with tokenized Git URLs from the same guide, credentials or repository metadata may be persisted.
Medium
SKILL.md:290
Hardcoded URL
npm install -g git+https://github.com/JEO-tech-ai/supercode.git#main
This installs the same hardcoded external repository from main as a global package. Global installation of mutable remote code increases host impact.
Medium
SKILL.md:51
SSH protocol URL
npm install -g git+ssh://git@github.com:JEO-tech-ai/supercode.git#main
The SSH install uses the user's GitHub SSH identity to fetch remote package code. That is an intended workflow, but it relies on authenticated network access.
Medium
SKILL.md:130
SSH protocol URL
"my-package": "git+ssh://git@github.com:owner/repo.git#v1.0.0",
The dependency example stores an SSH Git URL in package metadata. It can trigger authenticated network access and remote package execution during install.
Medium
SKILL.md:164
SSH protocol URL
npm install git+ssh://git@github.com:owner/private-repo.git
The private repository install uses SSH authentication. It is legitimate, but it lets npm fetch and build code using the user's GitHub identity.
Medium
SKILL.md:201
Hidden file access
echo 'export PATH=~/.npm-global/bin:$PATH' >> ~/.bashrc
The command writes to ~/.bashrc to alter future shells. The content is simple PATH configuration, but it is still a persistent hidden-file modification.

Risk findings

Confirmed security concerns are separated from items that still need review.

Confirmed security concerns (5)

RISK-001 High
SKILL.md:181
NPM config file (may contain tokens)
### .npmrc Configuration
The section explicitly covers .npmrc authentication configuration. npm config files may contain tokens and need least-privilege handling.
RISK-002 High
SKILL.md:184
NPM config file (may contain tokens)
# ~/.npmrc
The guide names ~/.npmrc immediately before an auth token entry. This is a real credential-handling surface, even though the token is variable-based.
RISK-003 High
SKILL.md:36SKILL.md:73-74
Mutable Git Install Can Execute Remote Package Scripts
The guide explains that npm Git installs clone a repository, install dependencies, and run a prepare script. Examples that install from main increase supply-chain risk because remote lifecycle scripts can change over time.
The file explicitly documents npm running prepare during Git installs and shows mutable main-branch installs. This is legitimate package-manager behavior, but it is a clear remote code execution surface.
RISK-004 High
SKILL.md:224-227
Plaintext Credential Helper Recommendation
The authentication troubleshooting section recommends the Git credential helper named store. That helper can persist credentials in plaintext on disk on common Git installations.
The recommendation is directly present in the troubleshooting section. The security impact depends on the platform, but credential.helper store is a known plaintext storage risk.
RISK-005 Low
SKILL.md:196
System reconnaissance
sudo chown -R $(whoami) /usr/local/lib/node_modules
The command runs whoami as part of a privileged ownership change. The reconnaissance value is limited, but it does inspect local account identity.

Remediation

Suggested fixes recorded by this audit. Applying them is the maintainer’s responsibility.

  1. FIX-001
    High
    Token-bearing Git URLs and npmrc examples can expose GitHub credentials.
    Remove token-in-URL examples, prefer SSH or scoped npm auth, and warn users not to log tokenized install commands.
  2. FIX-002
    High
    Mutable branch installs and npm prepare scripts create supply-chain execution risk.
    Use tags or commit hashes in production examples and require review of lifecycle scripts before installation.
  3. FIX-003
    High
    The troubleshooting section includes sudo and persistent shell configuration changes.
    Replace broad sudo chown guidance with user-level npm configuration and require confirmation before editing shell startup files.
  4. FIX-004
    High
    The Git credential helper store recommendation can persist credentials insecurely.
    Prefer platform keychain helpers or short-lived tokens, and document the storage risk of credential.helper store.

Expert evidence

Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.

Artifact subject

Marketplace commit
Unavailable
Content hash
Unavailable
Tree hash
Unavailable
Skill path
Unavailable
Audit payload hash
Unavailable

Analysis metadata

Audit model: codex

Analysis state: Complete

Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.

Static false positives ignored (2)
Critical
SKILL.md:160
SSH directory access
cat ~/.ssh/id_ed25519.pub
Force-confirmed sensitive/critical static finding; AI dismissal overridden.
Critical
SKILL.md:160
SSH private key file
cat ~/.ssh/id_ed25519.pub
Force-confirmed sensitive/critical static finding; AI dismissal overridden.

Verify and export

JSON report CITATION.cff SARIF 2.1.0 Signed installation manifest

The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.

Audit attestation: not_attestable