Security findings 7
Supply chain
mediumContextual risklow confidenceThe rule.md instructs the agent to globally install 'broken-link-checker' via npm with no version pin, placing unpinned registry code on the host PATH.
npm install -g broken-link-checker
vector:instruction
Counter-argument considered
The unpinned global npm install is quoted verbatim from the skill reference an agent reads and may execute; the registry-install carve-out requires a pin, and no declared claim or mitigation neutralizes the unpinned-install exposure. The strongest counter (installing the canonical link-checker serves the declared core capability) does not defeat the specific unpinned/mutable-code harm claimed.
Supply chain
mediumContextual risklow confidenceThe rule.md instructs the agent to run 'pip install linkchecker' with no version pin, fetching whatever unversioned release PyPI currently serves before the link-checking step runs.
pip install linkchecker
vector:instruction
Counter-argument considered
The pip install instruction is verbatim in the skill body with no version pin, so the pinned-registry carve-out does not apply; nothing shown declares or mitigates the unpinned PyPI fetch.
Supply chain
mediumContextual risklow confidenceThe example workflow invokes the third-party community action ruzickap/action-my-broken-link-checker pinned only to the mutable major tag @v2 rather than a commit SHA, so its executed code can change without notice in CI.
uses: ruzickap/action-my-broken-link-checker@v2
vector:instruction
Counter-argument considered
The workflow step references a third-party community action at the mutable major tag @v2 exactly as claimed; no shown evidence pins it to a SHA or otherwise negates the mutable-tag supply-chain concern, and the sibling lychee-action pin shows no global mitigation.
Privilege escalation
mediumContextual riskmedium confidenceThe GitHub Actions link-check example instructs the broken-link-checker action to run with --skip-tls-verification, disabling certificate validation while scanning links, which degrades transport security.
--skip-tls-verification
vector:codevector:instruction
Counter-argument considered
The cmd_params string passed to the executed action verbatim contains --skip-tls-verification, disabling certificate validation during the scan; no carve-out covers disabling TLS verification and no mitigation (the separate accept_invalid_certs=false lychee.toml example does not govern this action) is shown.
Supply chain
mediumContextual risklow confidenceThe GitLab CI example instructs installing 'lychee' globally from the npm registry even though the same reference installs the lychee link checker via cargo, so the undeclared, unpinned npm install could pull an unrelated package occupying that name.
npm install -g broken-link-checker lychee
vector:code
Counter-argument considered
The unpinned global npm install of broken-link-checker and lychee exists verbatim in the GitLab CI before_script; the same example runs lychee for link checking, but whether the npm 'lychee' name is an unrelated package is unproven from shown evidence, and no carve-out or declaration neutralizes the unpinned-install instruction.
Supply chain
mediumContextual risklow confidenceThe GitLab CI example pulls the mutable unpinned docker image lycheeverse/lychee:latest and globally installs unpinned npm packages (broken-link-checker, lychee), executing whatever remote code is current at run time.
image: lycheeverse/lychee:latest
vector:codevector:instruction
Counter-argument considered
The job verbatim pulls the mutable lycheeverse/lychee:latest tag, and the same shown CI file runs unpinned global npm installs in the sibling job; nothing shown pins these references or declares the behavior, so the supply-chain observation stands.
Supply chain
mediumContextual risklow confidenceThe rule.md instructs the agent to run 'cargo install lychee' with no version pin, installing unpinned crate code from crates.io into the environment before link checking.
cargo install lychee
vector:instruction
Counter-argument considered
The cargo install instruction is verbatim in the skill body with no version pin; the pinned-registry carve-out does not cover an unpinned crates.io install and no declared claim or mitigation neutralizes it.
