Announcing Beacon: Self-improving memory for coding agents
BeaconIntel
2.9K
← All skills
Skill

airtable-cli

skill:openai/plugins#airtable-cli

Lists bases, reads and writes records, manages tables and fields, filters and searches data in Airtable via the `airtable-mcp` CLI. Use when the task involves Airtable data or the user mentions airtable-mcp, bases, tables, records, or fields.

SkillsMP
Verdict
Suspicious

Risky behavior the analysis could not rule out.

Analyzed Oct 27, 2026, 22:02 UTC at 0722921

Dispute security verdict

If you believe this verdict is incorrect, submit a dispute and we'll review it.

2
findings
medium
highest severity
1
threat classes
5,479
files scanned
35/35
checks satisfied
0
package advisories

Why this verdict

  • suspicious: finding skill:plugins/airtable/skills/airtable-cli:plugins/airtable/skills/airtable-cli/SKILL.md:26:SUPPLY
  • suspicious: finding skill:plugins/airtable/skills/airtable-cli:plugins/airtable/skills/airtable-cli/SKILL.md:27:SUPPLY

Security findings 2

Supply chain

mediumContextual risklow confidence

The skill instructs the agent to globally install the npm package @airtable/mcp-cli with no version pin, so the code executed for every Airtable task is whatever latest version the registry serves at install time.

plugins/airtable/skills/airtable-cli/SKILL.md:26
npm install -g @airtable/mcp-cli
vector:instruction
Counter-argument considered

Strongest kill case is the pinned-registry/vendor-installer carve-outs, but both require a version pin and the command carries none, and no lockfile, pin, or integrity check appears anywhere in the shown units; the Install section sits in the skill body as a concrete agent instruction, so the mutable-latest supply exposure survives as a low-confidence contextual risk.

Supply chain

mediumContextual risklow confidence

The skill instructs the agent to run an unpinned global npm install of @airtable/mcp-cli as a prerequisite, which fetches and can execute vendor-controlled install-time code on the host before any task.

plugins/airtable/skills/airtable-cli/SKILL.md:27
npm install -g @airtable/mcp-cli
vector:instruction
Counter-argument considered

This is the same instruction and unit as the line-26 finding (the command sits on line 26; the cited line 27 is the adjacent code fence), but the quote and substance are accurate: an unpinned global npm install of the vendor package runs before any task, no carve-out applies without a pin, and the artifact contains no pin or integrity mitigation, so it stands.

Open questions 3

What the analysis could not settle from the code alone.

Detector leads (PY-CLAIM-CONTRADICTION / PY-CLAIM-RESIDUE) report an observed `file_write` capability with flags (--flagName, --input, --refresh, -q, --output, --profile, --help) that the skill text never declares and that would contradict the skill's guidance that tool `access` is limited to read-only/write/destructive; no such capability is visible in any shown unit, so it cannot be confirmed or refuted from this surface, and the underlying CLI is an npm dependency outside this pass's scope.
Persistence
[file request plugins/airtable/skills/airtable-filters/SKILL.md] The airtable-cli skill steers the agent to the airtable-filters skill for compound/date filter details ('The `airtable-filters` skill covers compound filters, date filters, and operator-by-field-type details.'); does that referenced skill contain instructions steering the agent beyond Airtable filtering (hijack, hidden directives, or out-of-scope actions)?
Agent hijacking
[file request plugins/airtable/skills/airtable-filters/SKILL.md] SRC:4f53d0f573c981f6 directs the agent to the airtable-filters skill for compound-filter details; does that referenced skill contain only Airtable filter documentation, or any instructions or capabilities beyond that scope?
Agent hijacking

Coverage gaps 14

Parts of the artifact the static analysis could not fully examine.

context:unanalyzable_binary binary content is only byte-scanned
plugins/codex-security/mcp/helpers.mjs.br.part-000
context:unanalyzable_binary macho content is only byte-scanned
plugins/codex-security/mcp/native/darwin-arm64/unix.node
context:unanalyzable_binary macho content is only byte-scanned
plugins/codex-security/mcp/native/darwin-x64/unix.node
context:unanalyzable_binary elf content is only byte-scanned
plugins/codex-security/mcp/native/linux-arm64-gnu/unix.node
context:unanalyzable_binary elf content is only byte-scanned
plugins/codex-security/mcp/native/linux-arm64-musl/unix.node
context:unanalyzable_binary elf content is only byte-scanned
plugins/codex-security/mcp/native/linux-x64-gnu/unix.node
context:unanalyzable_binary elf content is only byte-scanned
plugins/codex-security/mcp/native/linux-x64-musl/unix.node
context:unanalyzable_binary pe content is only byte-scanned
plugins/codex-security/mcp/native/win32-arm64/windows.node
context:unanalyzable_binary pe content is only byte-scanned
plugins/codex-security/mcp/native/win32-x64/windows.node
context:unanalyzable_binary binary content is only byte-scanned
plugins/codex-security/mcp/server.mjs.br.part-000
context:unanalyzable_binary binary content is only byte-scanned
plugins/codex-security/mcp/server.mjs.br.part-001
context:oversize archive member exceeds 8388608 bytes; truncated, no text
plugins/shopify/skills/shopify-admin/assets/admin_2026-04.json.gz!/admin_2026-04.json
context:decoded_views_exceeded 452 derived view(s) beyond the per-file view cap: decoded:charcode, decoded:rot13, decoded:unicode-escape
plugins/creative-production/mcp/server.bundle.mjs
context:bytes_unavailable yara-x: no bytes to scan
plugins/shopify/skills/shopify-admin/assets/admin_2026-04.json.gz!/admin_2026-04.json