ClawHub
Back to skill

Security audit

Markdown Browser

Security checks for vulnerabilities and agentic risk

Overview

The skill behaves like a web_fetch post-processing wrapper, but its normal npm install path uses plaintext third-party dependency URLs that deserve review before installation.

Review or regenerate the npm lockfile before installing. Prefer an HTTPS trusted registry, exact dependency versions, and npm ci with integrity enforcement; the skill logic itself is narrowly scoped, but the dependency download path should be fixed.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
package-lock.json:13
Finding
Runtime Dependencies Retrieved from a Third-Party Mirror over Plaintext HTTP## Vulnerability Details **File Location**: `package-lock.json:13-20` **Vulnerability Type**: Insecure dependency source and transport **Risk Level**: Medium ### Vulnerable Code ```json "node_modules/@mixmark-io/domino": { "version": "2.2.0", "resolved": "http://mirrors.tencentyun.com/npm/@mixmark-io/domino/-/domino-2.2.0.tgz", "integrity": "sha512-Y28PR25bHXUg88kCV7nivXrP2Nj2RueZ3/l/jdx6J9f8J4nsEGcgX0Qe6lt7Pa+J79+kPiJU3LguR6O/6zrLOw==", "license": "BSD-2-Clause" }, "node_modules/turndown": { "version": "7.2.2", "resolved": "http://mirrors.tencentyun.com/npm/turndown/-/turndown-7.2.2.tgz", "integrity": "sha512-1F7db8BiExOKxjSMU2b7if62D/XOyQyZbPKq/nUwopfgnHlqXHqQ0lvfUTeUIr1lZJzOPFn43dODyMSIfvWRKQ==", "license": "MIT", "dependencies": { "@mixmark-io/domino": "^2.2.0" } } ``` ### Technical Analysis The lockfile directs npm to download both runtime packages from a third-party mirror using unauthenticated, unencrypted HTTP. The documented installation procedure executes `npm install --omit=dev`, so these URLs participate directly in the normal installation path. Plaintext HTTP permits an on-path party to observe, block, redirect, or modify dependency responses. The included SHA-512 integrity values materially mitigate package substitution because npm should reject an archive whose contents do not match the lockfile. Consequently, arbitrary package replacement through a simple man-in-the-middle attack is not expected to succeed while integrity verification remains enabled and the lockfile remains trusted. Nevertheless, the configuration unnecessarily relies on an untrusted transport and a nonstandard mirror, exposes dependency-request metadata, and permits denial of service or redirection attempts. Risk increases if the lockfile is modified, integrity checking is bypassed, or installation tooling does not enforce the integrity field. The manifest also declares `turndown` with the range `^7 ...[truncated 1928 chars]
Remediation
## Remediation Suggestions 1. Regenerate `package-lock.json` using the official npm registry over HTTPS: ```bash npm config set registry https://registry.npmjs.org/ rm -rf node_modules package-lock.json npm install --package-lock-only ``` 2. Verify that every `resolved` URL in the regenerated lockfile uses HTTPS and points to an approved registry. 3. Pin the direct dependency exactly in `package.json`: ```json { "type": "module", "dependencies": { "turndown": "7.2.2" } } ``` 4. Use deterministic installation in documentation and deployment: ```bash npm ci --omit=dev --ignore-scripts ``` `--ignore-scripts` reduces lifecycle-script exposure where package functionality does not require installation scripts. 5. Add CI validation that rejects lockfiles containing `http://` dependency URLs or unapproved registries. 6. Retain and verify lockfile integrity hashes, review dependency updates, and periodically run an appropriate dependency vulnerability scanner.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Lp3

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding
Without declared permissions the skill's intent is opaque and cannot be validated.

Unpinned Dependencies

Low
Category
Supply Chain
Content
{"type":"module","dependencies":{"turndown":"^7.2.2"}}
Confidence
92% confidence
Finding
The dependency uses a caret range (^7.2.2), which allows automatic installation of newer non-major versions. This can introduce supply-chain risk because builds are not fully reproducible and a compromised or flawed upstream release could be pulled in without an explicit review. In this skill, the risk is somewhat limited because the package is a common markdown conversion library and no obviously dangerous install scripts or privileged operations are shown, but the dependency control weakness is still real.

Static analysis

No suspicious patterns detected.