ClawHub
Back to skill

Security audit

React Router Code Review

Security checks for vulnerabilities and agentic risk

Overview

This React Router review skill is mostly instructional, but it requires an unreviewed sibling skill to control part of its review process.

Review or pin the referenced review-verification-protocol skill before installing. Treat the React Router guidance as advisory, and be careful with the error-logging examples so production apps do not send sensitive error details to analytics or monitoring services.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:62
Finding

Mandatory Unpinned External Skill Dependency

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:62-64
Vulnerability Type: Unverified external instruction dependency
Risk Level: Medium

Vulnerable Code

md
### Gate 4 — Verification protocol

Load and follow [review-verification-protocol](../review-verification-protocol/SKILL.md). **Pass when:** Its pre-report checklist (and any issue-type subsection that applies) is complete for each finding you will output.

Technical Analysis

The Skill requires the Agent to load and follow another SKILL.md located outside the audited package. The referenced file is not included in the project, and the dependency is not version-pinned or protected by an integrity check.

As a result, the reviewed files do not fully define the Skill's effective instructions. Any party able to create or modify the sibling ../review-verification-protocol/SKILL.md file can change the protocol after this Skill has been reviewed. Because loading that file is presented as a mandatory gate, its instructions may influence which findings are reported and how the Agent behaves.

This is an insecure supply-chain boundary rather than evidence that the current package is itself malicious.

Attack Path

  1. An attacker obtains write access to the parent package directory or controls installation of the sibling review-verification-protocol package.
  2. The attacker creates or modifies ../review-verification-protocol/SKILL.md.
  3. A user invokes this React Router review Skill.
  4. Gate 4 directs the Agent to load and follow the attacker-controlled sibling file.
  5. The external instructions may suppress findings, manipulate review output, or request access unrelated to the legitimate review.
  6. The malicious content can subsequently change without any modification to the audited package.

Impact Assessment

Exploitation does not directly grant operating-system privileges. Its scope is the Agent session and any tools or data al ...[truncated 337 chars]

Remediation
View remediation

Remediation Suggestions

  1. Include the verification protocol inside the reviewed Skill package and reference it with an in-package path.
  2. If an external protocol is unavoidable, pin it to an immutable version and verify its cryptographic hash before use.
  3. Treat externally loaded Skill text as untrusted input rather than automatically authoritative instructions.
  4. Document the dependency and include it in the same security-review scope.
  5. Fail safely when the expected protocol is missing or fails integrity validation.
  6. Prevent external protocol files from expanding tool access, changing safety constraints, or overriding the parent Skill's stated review purpose.

T09 · Insecure Skill Coding Practices

Warning
Location
references/error-handling.md:375
Finding

Recommended Error Telemetry May Expose Sensitive Data

Content
View full analysis

Vulnerability Details

File Location: references/error-handling.md:375-433
Vulnerability Type: Unsanitized transmission of error details to monitoring and analytics services
Risk Level: Medium

Vulnerable Code

tsx
### 6. Not Logging Errors

**Problem**: No visibility into production errors, hard to debug.

// GOOD - Errors logged to monitoring service
function ErrorBoundary() {
  const error = useRouteError();

  React.useEffect(() => {
    // Log to error tracking service
    if (isRouteErrorResponse(error)) {
      logError({
        type: 'RouteError',
        status: error.status,
        statusText: error.statusText,
        data: error.data,
      });
    } else if (error instanceof Error) {
      logError({
        type: 'JavaScriptError',
        message: error.message,
        stack: error.stack,
      });
    } else {
      logError({
        type: 'UnknownError',
        error: String(error),
      });
    }
  }, [error]);

  return <ErrorDisplay error={error} />;
}

// BETTER - Centralized error logging
function useErrorLogging(error: unknown) {
  React.useEffect(() => {
    // Don't log in development
    if (import.meta.env.DEV) return;

    // Send to monitoring service (Sentry, etc.)
    if (isRouteErrorResponse(error)) {
      window.analytics?.track('Route Error', {
        status: error.status,
        statusText: error.statusText,
        path: window.location.pathname,
      });
    } else if (error instanceof Error) {
      window.analytics?.track('JavaScript Error', {
        message: error.message,
        stack: error.stack,
        path: window.location.pathname,
      });
    }
  }, [error]);
}

Technical Analysis

The reference recommends forwarding raw route-response data, exception messages, stack traces, and application paths to unspecified monitoring or analytics services. It doe ...[truncated 1954 chars]

Remediation
View remediation

Remediation Suggestions

  1. Replace raw error serialization with a strict allowlist of non-sensitive fields, such as an internal event identifier and normalized error category.
  2. Redact credentials, session identifiers, authorization headers, cookies, personal information, query parameters, and request or response bodies.
  3. Do not transmit production stack traces to general-purpose analytics platforms; use a restricted error-monitoring service with appropriate access controls.
  4. Validate and explicitly configure telemetry destinations rather than relying on an unspecified global logger.
  5. Remove query strings and sensitive path segments before recording URLs.
  6. Apply environment, consent, regional-processing, retention, and deletion controls.
  7. Add automated tests using canary secrets to verify that the telemetry pipeline performs redaction.
  8. Document that user-controlled exception text must not be treated as safe telemetry.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 40)May include surrounding context.

md
- **Empty errorElement at route level** - Route may intentionally rely on parent error boundary
- **Form without action prop** - Posts to current URL by convention; explicit action is optional
- **loader returning null** - Valid when data may not exist; null is a legitimate loader return value
- **Using fetcher.data without checking fetcher.state** - May be intentional when stale data is acceptable during revalidation

## Context-Sensitive Rules

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/navigation.md (reported line 330)May include surrounding context.

}

text

### 6. Blocking Navigation Without Confirmation

**Problem**: Lost unsaved changes, data loss.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/navigation.md (reported line 335)May include surrounding context.

Problem: Lost unsaved changes, data loss.

tsx
// BAD - No confirmation on navigation
function EditUser() {
  const [formData, setFormData] = useState({});
  const [isDirty, setIsDirty] = useState(false);