Snyk audit flags worktrunk skill with critical risk level

[aspiers]

Snyk is still flagging the worktrunk skill as having critical risk level: https://www.skills.sh/max-sixty/worktrunk/worktrunk/security/snyk

Originally posted by @aspiers in #3145

[worktrunk-bot]

Thanks for filing. The rating is real but the audit behind it is stale, and I can now show that precisely: skills.sh has already re-indexed the current skill content, yet is still serving audit results from 2026-05-29. The wording Snyk objects to was rewritten three weeks after that scan in #3146 (merged 2026-06-20), with further edits in #3494 (2026-07-16).

Both halves are checkable from skills.sh's own public API:

# Indexed content — SKILL.md digest matches this repo's main exactly
curl -s https://www.skills.sh/api/download/max-sixty/worktrunk/worktrunk \
  | python3 -c 'import json,sys,hashlib; print(*[(f["path"], hashlib.sha256(f["contents"].encode()).hexdigest()) for f in json.load(sys.stdin)["files"] if f["path"]=="SKILL.md"])'
# → ('SKILL.md', '0a217b6b0a30588569bf97d5ad828d07aaf8241c67e2855ef461233098ec8c53')

# Audit results — every one predates the fix
curl -s https://www.skills.sh/api/v1/skills/audit/max-sixty/worktrunk/worktrunk | jq '.audits[] | {provider, status, riskLevel, auditedAt}'
# → Snyk fail CRITICAL 2026-05-29T04:41:08Z · Gen pass SAFE 2026-05-29 · Socket pass 2026-05-29

So indexing and auditing are decoupled upstream: the content refreshed, the scan didn't re-run. That's the failure mode consolidated in vercel-labs/skills#707, and worktrunk is a clean instance of it — no repo-side change is pending, the panel is just showing a scan of text that no longer exists.

Two more things worth having on the record. First, Snyk's E006 is "malicious code pattern detected in skill scripts" — the worktrunk skill is 17 markdown files with zero scripts and zero executables. Second, it's the outlier: on the same snapshot, Gen Agent Trust Hub returns SAFE, and its summary reads "…all of which are documented features accompanied by explicit instructions for the agent to respect user-approval security boundaries." Socket returns 0 alerts. Three scanners, one dissent.

On whether a rescan would turn it green, I'd temper expectations. The finding text describes worktrunk's actual capability surface — hooks and aliases run commands committed in the repo, [commit.generation] pipes a diff to a user-chosen CLI, plugin install writes to user files. Those are the features, and the June change made the skill lead with the gate on them: Worktrunk never runs a project's hooks until the user has explicitly approved them, wt config approvals add is the recommended path, and an agent must not reach for --yes on the user's behalf (SKILL.md L110-L128). Rewording further to dodge a keyword match seems like the wrong trade. If a fresh scan still fails, the honest reading is that this scanner is rating the tool's feature set rather than the skill's guidance.

How a rescan gets triggered, per a vercel-labs/skills collaborator: "it will be rescanned upon a new installation" (#575), and "skills are automatically indexed when they are installed via the CLI" (#815). I ran npx skills add https://github.com/max-sixty/worktrunk --skill worktrunk in a clean directory today; the audit timestamps hadn't moved when I checked immediately afterwards, so if that's the trigger it isn't synchronous — one author reports re-scans landing within ~3 days. Re-running the audit curl above in a few days is the cheap check.

@max-sixty — if that doesn't shift it, the fallback is a rescan request upstream, and those do get actioned (#575, #815, #1673 all closed after one). Filing or commenting in other repos is off by default for me, so: say the word and I'll open it with the digest/timestamp evidence above, or if you'd rather not be asked each time, that permission can go in .claude/skills/running-tend/SKILL.md.

Evidence and raw data

Audit API response (2026-08-06), verbatim fields:

• Snyk — status: fail, summary: "Risk: CRITICAL · 1 issue", auditedAt: 2026-05-29T04:41:08.767591+00:00
• Gen Agent Trust Hub — status: pass, riskLevel: SAFE, auditedAt: 2026-05-29T04:41:31.316Z
• Socket — status: pass, summary: "No alerts", auditedAt: 2026-05-29T04:41:22.832Z
• Runlayer — status: fail, riskLevel: HIGH, summary: "10/16 files flagged", auditedAt: 2026-03-16T01:33:16.704Z (not shown on the page; older still, and its file count predates a reference doc that has since been added)
• ZeroLeaks — status: pass, summary: "Score: 93/100", auditedAt: 2026-04-16T13:24:19.231Z

Snyk finding text (E006), verbatim: "LLM commit-generation and summary commands pipe diffs/prompts to external agent CLIs (potentially exfiltrating source or secrets), project hooks and aliases can execute arbitrary shell commands committed in the repo (remote code execution/backdoor potential), plugin installs and shell-integration modify user files and drop code, and CI/approval bypass options (--yes, pre-approved approvals) lower the barrier to silent execution — together these create clear avenues for intentional data exfiltration and remote code execution if misused."

Skill history relative to that scan: 9147c0e (#3146, 2026-06-20) "docs(skill): frame hook approvals as user consent, stop advocating --yes"; 568b6de (#3494, 2026-07-16). Both post-date 2026-05-29.

Digest chain: the indexed bundle's SKILL.md, the working tree at 3817df0, and the digest published in docs/static/.well-known/agent-skills/index.json all give 0a217b6b0a30588569bf97d5ad828d07aaf8241c67e2855ef461233098ec8c53.

Install output, verbatim risk row: worktrunk Gen: Safe Socket: 0 alerts Snyk: Critical Risk.

One unverified thread worth noting: in #1673, the audit did refresh, and that author had published a new release alongside re-running npx skills add. Whether a version bump is part of the trigger is not something I could establish — the worktrunk skill carries no version key (dropped in #2747 as off-spec), so if that turns out to matter it would be a separate question.

Unrelated, for the record: the tend-triage run for this issue (31119109457) failed during "Set up job" with Failed to resolve action download info. Error: Service Unavailable — transient Actions infrastructure. That's why the issue sat untriaged; I picked it up from the #3145 mention instead.

[max-sixty]

yes file upstream please @worktrunk-bot

[worktrunk-bot]

Filed: vercel-labs/skills#1889.

It carries the evidence from above — indexed SKILL.md digest 0a217b6b… matching 3817df0 byte-for-byte, the Snyk result still stamped 2026-05-29, and the 9147c0e diff showing that the --yes framing the finding cites was replaced on 2026-06-20 — and asks only that the verdict be recomputed against the published text, not that it come back green. I said as much in the issue: hooks running repo-committed commands and [commit.generation] piping a diff to a CLI are real features, so a fresh scan may well still flag them, and that would at least be a verdict on the current skill.

Two additions since yesterday. I re-ran npx skills add in a clean directory today (skills CLI 1.5.22, Node v22.23.1) and re-checked with a cache-busted request: all five audit timestamps unchanged, so two installs across two days have not triggered a rescan here. And the upstream consolidation thread #707 has picked up a counter-example — one author reports an install that did refresh both content and audit on 2026-08-04 — so the install trigger looks inconsistent across repos rather than absent. That's in the issue too, since it's a useful data point for the underlying bug.

Nothing further is needed on our side. The cheap check in a few days is the same one-liner:

curl -s https://www.skills.sh/api/v1/skills/audit/max-sixty/worktrunk/worktrunk | jq '.audits[] | {provider, status, riskLevel, auditedAt}'

I'll pick it up if there's a reply upstream.