ClawHub
Back to skill

Security audit

JustFix

Security checks for vulnerabilities and agentic risk

Overview

The skill largely does what it claims, but it deserves Review because it can send household repair details to a commercial MCP service on broad triggers and one Codex install path runs an unpinned npm proxy.

Review before installing, especially on Codex CLI. Prefer a pinned reviewed mcp-remote version or a locked local install, and configure the agent to ask before sending repair details to JustFix unless the user clearly requested a quote or booking link.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
install/codex-cli.md:10
Finding

Unpinned Third-Party Package Is Downloaded and Executed Automatically

Content
View full analysis

Vulnerability Details

File Location: install/codex-cli.md, lines 10–13
Vulnerability Type: Unpinned third-party dependency execution
Risk Level: Medium

toml
[mcp_servers.justfix-estimator]
command = "npx"
args = ["-y", "mcp-remote@latest", "https://estimator-mcp.justfix.app/mcp"]

Technical Analysis

The recommended Codex CLI configuration invokes npx with both -y and mcp-remote@latest. This causes the current package version selected by the npm latest tag to be downloaded and executed without interactive confirmation whenever the MCP process is launched.

Because latest is mutable, the code executed by users can change after this Skill has been reviewed. The repository therefore does not provide a reproducible or reviewable dependency version. If the package publisher, npm account, package distribution process, or a future release is compromised, arbitrary code could execute under the account running Codex.

This is a supply-chain vulnerability rather than evidence that the current mcp-remote package is malicious.

Attack Path

  1. An attacker compromises the mcp-remote package, its maintainer account, or its release process.
  2. The attacker publishes a malicious version and assigns it to the npm latest tag.
  3. A user follows the documented configuration and starts Codex CLI.
  4. Codex launches the configured MCP command.
  5. npx -y mcp-remote@latest retrieves the attacker-controlled release without requesting confirmation.
  6. The malicious package executes locally with the privileges and environment of the Codex process.

Impact Assessment

Successful exploitation could provide arbitrary code execution with the permissions of the user running Codex. Depending on that account's environment and filesystem access, an attacker could potentially:

  • Read or modify files accessible to the user, including source repositories.
  • Access environment variables and credentials exposed to the Codex process.
  • Make outbou ...[truncated 322 chars]
Remediation
View remediation

Remediation Suggestions

  1. Replace mcp-remote@latest with an exact, reviewed version:
    toml
    [mcp_servers.justfix-estimator]
command = "npx"
args = ["-y", "mcp-remote@<audited-exact-version>", "https://estimator-mcp.justfix.app/mcp"]
  2. Record and review dependency updates instead of following the mutable latest tag automatically.
  3. Prefer a locally installed dependency governed by a lockfile so the resolved version and transitive dependency graph are reproducible.
  4. Where supported, verify package integrity using a trusted checksum or registry integrity metadata.
  5. Run the MCP proxy with least privilege and prevent unnecessary access to sensitive repositories, credentials, and environment variables.
  6. Document the package's provenance and a controlled update procedure that includes release-note review and security testing.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (19)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 211)May include surrounding context.

md
All harnesses follow the same pattern: register the MCP endpoint, then put this `SKILL.md` somewhere the agent's skill discovery can find it.

Agent Config Directory Access

High
Category
Agent Snooping
Confidence
90% confidence
Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · install/codex-cli.md (reported line 3)May include surrounding context.

md
# Installing JustFix Skill on Codex CLI

[Codex CLI](https://github.com/openai/codex) is OpenAI's terminal-based coding assistant. It supports MCP servers via its `~/.codex/config.toml`.

## Step 1: Register the MCP server

Agent Config Directory Access

High
Category
Agent Snooping
Confidence
90% confidence
Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · install/codex-cli.md (reported line 7)May include surrounding context.

md
# Installing JustFix Skill on Codex CLI

[Codex CLI](https://github.com/openai/codex) is OpenAI's terminal-based coding assistant. It supports MCP servers via its `~/.codex/config.toml`.

## Step 1: Register the MCP server

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The README encourages users to request quotes and book services, but it does not clearly disclose at the point of use that user-supplied job details are sent to a third-party public MCP server and that the returned booking URL contains a unique tracking identifier for attribution. In an agent setting, this omission can cause inadvertent sharing of sensitive household, repair, or location-related information without informed user consent, especially because the skill is marketed as plug-and-play with 'no auth, no config, no API keys'.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The trigger set includes very broad repair/problem phrases such as broken household items and generic requests for a tradesperson, which can cause the skill to activate when the user did not explicitly ask for a quote or booking flow. In a tool-calling agent, unintended invocation can route user context to the external MCP endpoint and steer the conversation toward a commercial booking link without sufficiently clear user intent.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
85% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · install/claude-code.md (reported line 30)May include surrounding context.

Step 2: Add the skill to your Claude Code skills folder

bash
mkdir -p ~/.claude/skills
cd ~/.claude/skills
git clone https://github.com/Just-Fix/justfix-skill.git justfix

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · install/claude-code.md (reported line 30)May include surrounding context.

Step 2: Add the skill to your Claude Code skills folder

bash
mkdir -p ~/.claude/skills
cd ~/.claude/skills
git clone https://github.com/Just-Fix/justfix-skill.git justfix

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
85% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · install/claude-code.md (reported line 35)May include surrounding context.

git clone https://github.com/Just-Fix/justfix-skill.git justfix

text

Claude Code picks up skills from `~/.claude/skills/` automatically.

## Step 3: Verify

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
85% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · install/codex-cli.md (reported line 20)May include surrounding context.

Step 2: Drop the skill into Codex's instructions folder

bash
mkdir -p ~/.codex/skills
cd ~/.codex/skills
git clone https://github.com/Just-Fix/justfix-skill.git justfix

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · install/codex-cli.md (reported line 20)May include surrounding context.

Step 2: Drop the skill into Codex's instructions folder

bash
mkdir -p ~/.codex/skills
cd ~/.codex/skills
git clone https://github.com/Just-Fix/justfix-skill.git justfix

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
85% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · install/codex-cli.md (reported line 28)May include surrounding context.

Then add a reference in your ~/.codex/AGENTS.md or project AGENTS.md:

markdown
## Available Skills

- **justfix** – quote UK trades jobs. See `~/.codex/skills/justfix/SKILL.md` for the full skill.

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · install/codex-cli.md (reported line 30)May include surrounding context.

markdown
## Available Skills

- **justfix** – quote UK trades jobs. See `~/.codex/skills/justfix/SKILL.md` for the full skill.

Codex CLI reads AGENTS.md at session startup and picks up the skill reference automatically.

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · install/hermes.md (reported line 35)May include surrounding context.

markdown
## Available Skills

- **justfix** – quote UK trades jobs. See `~/.codex/skills/justfix/SKILL.md` for the full skill.

Codex CLI reads AGENTS.md at session startup and picks up the skill reference automatically.

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · install/openclaw.md (reported line 62)May include surrounding context.

markdown
## Available Skills

- **justfix** – quote UK trades jobs. See `~/.codex/skills/justfix/SKILL.md` for the full skill.

Codex CLI reads AGENTS.md at session startup and picks up the skill reference automatically.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The recommended trigger list ("quote, estimate, price, trades, plumbing, electrical") is broad enough to activate in many normal conversations, causing the skill to run when the user did not clearly request a JustFix estimate. Because the skill connects to an external MCP service and can return booking links, unintended activation can leak user context to a third party and steer users into an external commercial flow without sufficiently explicit intent.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · install/gemini-cli.md (reported line 7)May include surrounding context.

Step 1: Register the MCP server

Edit ~/.config/gemini-cli/config.json (create if it doesn't exist):

json
{

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
71% confidence
Finding

The README states 'UK only' as a hard constraint. While the service may in practice be region-specific, the description does not frame this as a documented locale limitation with justification in the policy sense beyond a brief statement, so it can be read as a locale restriction without user opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
79% confidence
Finding

The instruction says users outside the UK should only be quoted if they confirm they are in the UK or want a UK quote anyway, which imposes a locale restriction in the skill behavior. While the file notes the service is UK-only, it does not clearly frame this as a justified regional compliance or operational constraint beyond a brief statement, so it may conflict with the locale-policy rule.

Content

No source excerpt is available for this finding.

Vague Triggers

Low
Category
Not specified by scanner
Confidence
86% confidence
Finding

The instruction says to 'send any message to pick up the new skill,' which is an overly broad trigger phrase overlapping with normal everyday speech. It does not clarify whether this is only for reloading/discovery behavior or what messages would not trigger the skill, making activation scope ambiguous.

Content

No source excerpt is available for this finding.