Why this verdict
- suspicious: finding skill:docs/public/skills/write-voyager-plugin:docs/public/skills/write-voyager-plugin/SKILL.md:14:SUPPLY
- suspicious: finding skill:docs/public/skills/write-voyager-plugin:docs/public/skills/write-voyager-plugin/SKILL.md:27:SUPPLY
- suspicious: finding skill:docs/public/skills/write-voyager-plugin:docs/public/skills/write-voyager-plugin/SKILL.md:28:SUPPLY
- suspicious: finding skill:docs/public/skills/write-voyager-plugin:docs/public/skills/write-voyager-plugin/SKILL.md:30:SUPPLY
Security findings 4
Supply chain
highContextual riskhigh confidenceThe skill conditionally instructs the agent to fetch its instruction files from the mutable remote host voyager.nagi.fun whenever the local copies are missing, so the instructions the agent follows can be changed server-side after review.
fetch it from https://voyager.nagi.fun/skills/write-voyager-plugin/<path>
conceal:remotetrigger:conditionalvector:instruction
Counter-argument considered
The quote matches the claim: the skill body instructs the agent to pull its companion instruction files from voyager.nagi.fun whenever local copies are absent. Strongest counter-case is that the fetch is openly declared in the same sentence (undeclared gate fails), but disclosure is not a listed carve-out and nothing pins, checksums, or verifies the remote content, so the post-review server-side mutation vector stands.
Supply chain
mediumContextual riskmedium confidenceThe workflow directs the agent to run npx create-voyager-plugin@latest init and check before and after writing the plugin, downloading and executing the unpinned latest version of an npm package from the registry at runtime.
`npx create-voyager-plugin@latest init my-plugin --site <site>`
vector:instruction
Counter-argument considered
Step 1 of the workflow is a concrete instruction to npx-install and execute create-voyager-plugin at the unpinned @latest tag; the carve-out covers pinned official-registry installs only, and the manual 'Without Node' fallback neither removes the npx instruction nor pins a version, so the claim survives despite being openly declared.
Supply chain
mediumContextual risklow confidenceThe workflow instructs the agent to run the npm package create-voyager-plugin at the unpinned @latest tag to scaffold and check the plugin, downloading and executing mutable remote code as an authoring step.
npx create-voyager-plugin@latest init my-plugin --site <site>
vector:instruction
Counter-argument considered
The quote is the same init instruction as the prior finding, so this is largely duplicative, but no listed refutation ground applies: the quote means exactly what the claim says, the unpinned @latest execution is not a carve-out (only pinned installs are), and no mitigation pins or verifies the package, so it stands.
Supply chain
mediumContextual riskhigh confidenceThe skill's mandatory workflow instructs the agent to execute `npx create-voyager-plugin@latest` (init and check), downloading and running whatever code is currently published under that npm name with no version pin, so supply-chain code execution beyond authoring JSON+CSS is introduced and cannot be verified at the pinned commit.
Run `npx create-voyager-plugin@latest check my-plugin`.
vector:codevector:instruction
Counter-argument considered
Step 3 mandatorily runs the checker via the unpinned @latest tag, so whatever code npm currently serves under that name is downloaded and executed; the 'offline' wording describes the check itself, not the registry download, and no pin or verification exists, so the unverifiable-at-commit execution claim holds. The behavior is declared, but declaration alone is not a carve-out here.
Open questions 3
What the analysis could not settle from the code alone.
Whether voyager.nagi.fun and the npm package create-voyager-plugin are authentic vendor-controlled channels for Voyager cannot be verified from the artifact; if they are not, the remote doc fetch and the npx execution become attacker-controlled.
Supply chain
Detector DET:c4ce564cdce7838c cites the claim 'No web fonts, no remote images.' at SKILL.md line 14, but the shown span at that line contains only the remote-fetch instruction; the claim text is not visible in any shown unit, so the alleged contradiction between a no-remote-resources claim and fetching reference files from voyager.nagi.fun cannot be confirmed or refuted from the evidence shown.
Supply chain
Detector DET:0d047508f206c9e9 claims a PERSIST contradiction in sites/gemini.md (a 'counterBadge' description contradicted by file_write '/'), but the counterBadge text appears nowhere in the shown span and the visible line-28 content only explains how draftSave keys drafts by pathname; no file-write instruction is visible, so the lead is unconfirmed.
Persistence
Execution chain 23
What it calls, runs, installs, reads and writes, with the line that does it.
Packages 2
npm:create-voyager-plugin@latest
npm:create-voyager-plugin@latest
URLs 19
https://*.frame.claudeusercontent.com/*
https://aistudio.google.cn/*
https://aistudio.google.com/*
https://business.gemini.google/*
https://chat.deepseek.com/*
https://chat.openai.com/*
https://chat.openai.com/*
https://chat.openai.com/*
https://chat.openai.com/*
https://gemini.google.com/*
https://voyager.nagi.fun/plugin.schema.json
https://voyager.nagi.fun/skills/write-voyager-plugin/
https://voyager.nagi.fun/skills/write-voyager-plugin/SKILL.md
Coverage gaps 5
Parts of the artifact the static analysis could not fully examine.
context:unanalyzable_binary binary content is only byte-scanned
docs/public/assets/default-model.mp4
context:unanalyzable_binary binary content is only byte-scanned
docs/public/assets/hide-gem-list.mp4
context:unanalyzable_binary binary content is only byte-scanned
docs/public/assets/hide-my-stuff.mp4
context:unanalyzable_binary binary content is only byte-scanned
docs/public/assets/sidebar-auto-hide.mp4
context:unanalyzable_binary binary content is only byte-scanned
docs/public/favicon.ico
