40Medium
The skill executes unpinned npx packages at runtime, creating a critical supply chain vulnerability that allows for the potential execution of malicious or compromised code.
Skill Info
Namehalt-catch-fire/skills/ai-video-generation
Registrygithub
Version601a457f7ecf
PURLpkg:github/halt-catch-fire/skills@601a457f7ecf?skill=ai-video-generation
Stars584
Installs351,400
Source
SHA-25679b7d8b8dc87...
SHA-1958f368e100a...
MD5ad05a42f4bda...
TLSH0ae1c7534c90...
ssdeep192:OfrxEjVd...
Size7,406 bytes
Install
This skill has findings worth reviewing before installing.
GitHub
351,400 installs
Skills.shDocs
npx skills add https://github.com/halt-catch-fire/skillsAssessments (2)
AI Agent Traps ↗Unpinned npx package execution — `npx <pkg>` without a version pin pulls latest from npm at runtimemediumsupply chainAML.T0010AML.T0019AML.T0058LLM03:2025
Unpinned npx package execution — `npx <pkg>` without a version pin pulls latest from npm at runtime (seen 10 times in this file at lines 7, 218, 221, 224, 227, 230, 233, 236, 239, 242)
95% confidenceline 7
npx skills
Missing licenseinfopolicy violation
Skill does not specify a license field. Specifying a license helps users understand usage terms.
100% confidence
Badge
Markdown
[](https://mondoo.com/ai-agent-security/skills/github/halt-catch-fire/skills/ai-video-generation)HTML
<a href="https://mondoo.com/ai-agent-security/skills/github/halt-catch-fire/skills/ai-video-generation"><img src="https://mondoo.com/ai-agent-security/api/badge/github/halt-catch-fire/skills/ai-video-generation.svg" alt="Mondoo Skill Check" /></a>Image URL
https://mondoo.com/ai-agent-security/api/badge/github/halt-catch-fire/skills/ai-video-generation.svgSecure your AI agents
Skills can read files, run commands, and access credentials. Mondoo helps organizations manage the security risks of AI agent skills across their entire fleet.
- Continuous scanning of skills across all registries
- Policy enforcement before skills reach your agents
- Integration with your existing security workflow