ClawHub
Back to skill

Security audit

Zod

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent Zod v4 guidance skill with no executable payload, though its install examples should be treated with normal supply-chain caution.

Before installing, prefer a pinned skill source or reviewed commit and avoid global `-g` installation unless you want the skill available across projects. Treat the included CI `npx` examples as templates to adapt with pinned dev dependencies or locked package scripts.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T08 · Insecure Dependencies

Warning
Location
README.md:15
Finding

Unpinned Remote Skill Installation Executes Mutable Third-Party Code

Content
View full analysis

Vulnerability Details

File Location: README.md:15-24
Vulnerability Type: Unpinned third-party package and repository installation
Risk Level: Medium

Vulnerable Code

bash
## Install

npx skills add anivar/zod-skill -g

Or with full URL:

npx skills add https://github.com/anivar/zod-skill

Additional unpinned global installation recommendations appear in README.md:95-114, including:

bash
npx skills add anivar/jest-skill -g
npx skills add anivar/zod-testing -g
npx skills add anivar/msw-skill -g
npx skills add anivar/redux-saga-testing -g
npx skills add anivar/redux-saga-skill -g
npx skills add anivar/contributor-codebase-analyzer -g

Technical Analysis

The documented installation commands cause npx and the skill installer to retrieve and execute content identified by mutable package names, repository branches, or tags. No exact package version, immutable Git commit SHA, checksum, signature, or integrity metadata is specified.

Consequently, the code executed when a user follows these instructions can differ from the code that was originally audited. The -g option also installs several skills globally, increasing their availability and potential influence beyond one project.

This is a supply-chain weakness rather than evidence that the currently audited repository contains a malicious payload. The risk arises because a compromised publisher account, npm package, GitHub repository, dependency, or mutable branch could replace trusted content after review.

Attack Path

  1. An attacker compromises the relevant package publisher, GitHub repository, dependency, or distribution account.
  2. The attacker publishes malicious code under the same mutable package name or repository reference.
  3. A developer follows an installation command from the README.
  4. npx retrieves the current installer, and the installer retrieves the current skill content.
  5. The altered pac ...[truncated 854 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin the skills CLI to an exact reviewed version instead of relying on the version selected dynamically by npx.
  2. Pin GitHub installations to immutable commit SHAs rather than mutable default branches or tags.
  3. Pin every recommended skill to an exact reviewed release or commit.
  4. Publish and verify checksums or signatures for downloadable skill artifacts where supported.
  5. Prefer project-local installation over -g unless global scope is required.
  6. Document the files and permissions changed by global installation.
  7. In automated environments, install reviewed dependencies through a committed lockfile and use deterministic installation commands such as npm ci.
  8. Run installation in a sandbox with restricted filesystem, network, credential, and environment-variable access.

T08 · Insecure Dependencies

Warning
Location
references/linter-and-ci.md:143
Finding

CI Guidance Uses Unpinned npx Tool Execution

Content
View full analysis

Vulnerability Details

File Location: references/linter-and-ci.md:143-219
Vulnerability Type: Unpinned development tools executed in local and CI environments
Risk Level: Medium

Vulnerable Code

yaml
# .github/workflows/schema-check.yml
name: Schema Snapshot Check
on: [pull_request]

jobs:
  schema-check:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
      - run: npm ci
      - run: npx tsx scripts/export-schemas.ts
bash
npx tsx scripts/export-schemas.ts
npx knip --include exports
npx ts-prune | grep -i schema

# Find circular dependencies
npx madge --circular --extensions ts src/

# Generate dependency graph
npx madge --image graph.svg --extensions ts src/
yaml
- name: Check circular dependencies
  run: |
    npx madge --circular --extensions ts src/
    if [ $? -ne 0 ]; then
      echo "::error::Circular dependencies detected"
      exit 1
    fi

Technical Analysis

The guidance executes tsx, knip, ts-prune, and madge through npx without specifying exact versions. If these packages are absent from a locked local dependency tree, npx may retrieve current registry releases at execution time.

This creates a mutable code-execution boundary inside developer workstations and CI jobs. Package names resolve through the configured npm registry, so the effective executable can change independently of the audited repository. The risk includes publisher compromise, malicious updates, registry misconfiguration, dependency confusion involving an internal package namespace, and compromised transitive dependencies.

npm ci is deterministic only for packages represented in the committed lockfile. It does not make a later unversioned npx download deterministic when the requested CLI is not already locked and locally installed.

Attack Path

  1. An attacker gains contro ...[truncated 1262 chars]
Remediation
View remediation

Remediation Suggestions

  1. Add tsx, knip, ts-prune, and madge as exact-version development dependencies.
  2. Commit the package lockfile and install dependencies with npm ci.
  3. Invoke locked local binaries through package scripts, for example npm run export-schemas, rather than allowing npx to download missing tools.
  4. If npx must be retained, specify exact versions and disable implicit installation where supported.
  5. Pin GitHub Actions to immutable commit SHAs rather than moving major-version tags for stronger workflow reproducibility.
  6. Apply dependency review, provenance verification, vulnerability scanning, and controlled registry policies.
  7. Restrict CI token permissions to the minimum required and avoid exposing deployment or publication secrets to validation-only jobs.
  8. Disable unnecessary outbound network access after deterministic dependency installation.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (19)

Anti-Refusal Statement

High
Category
Anti-Refusal
Confidence
80% confidence
Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · references/boundary-architecture.md (reported line 199)May include surrounding context.

md
Always validate data coming from external services — their schemas can change without warning.

Rp1

Medium
Category
MCP Rug Pull
Confidence
89% confidence
Finding

The README instructs users to run npx skills add anivar/zod-skill -g without pinning the exact version of the skills package or the fetched skill content. npx resolves and executes the latest matching package at install time, which creates a supply-chain risk if the package is compromised or a breaking/malicious update is published.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
89% confidence
Finding

The full-URL install example still relies on npx skills add, which executes an unpinned package/toolchain and pulls remote content dynamically. Even though the repository URL is explicit, the command path remains vulnerable to package or dependency compromise and to changes in the referenced repository over time.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
86% confidence
Finding

This ecosystem listing includes an npx skills add command for another skill without version pinning. Recommending executable install commands in documentation broadens the attack surface because readers may run them directly, trusting the document as authoritative.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
86% confidence
Finding

The README provides another unpinned npx skills add invocation for a related package. Any command that causes users to execute the latest remotely resolved package can become dangerous if upstream artifacts are altered or hijacked.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
86% confidence
Finding

This install command again uses npx with an unpinned package and a mutable remote target. In documentation for agent skills, this is somewhat more sensitive because users may execute these commands automatically or with reduced scrutiny.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
86% confidence
Finding

The command invites direct execution of an unpinned package from documentation, which is a classic supply-chain risk pattern. If the package name, dependencies, or fetched skill source are compromised, users can execute attacker-controlled code during installation.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
85% confidence
Finding

This line repeats the same unpinned install pattern for another skill. While the README appears educational and not overtly malicious, repeated executable commands increase exposure because readers may copy/paste them without validating what npx will resolve at that moment.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
85% confidence
Finding

The install example relies on mutable upstream resolution and therefore remains susceptible to supply-chain compromise. In skill-distribution context, this is materially relevant because the package being installed can influence downstream AI tooling behavior and developer environments.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
85% confidence
Finding

The final npx skills add example has the same issue: users are instructed to execute a package and fetch content without immutable version constraints. This is dangerous because the trust decision is deferred to live remote infrastructure at execution time.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The trigger metadata includes broad natural-language phrases such as mentions of "zod" and "schema validation," which can cause the skill to activate in contexts where the user did not intend to invoke it. This is not a code-execution issue, but it can increase unintended routing, prompt interference, and over-application of the skill to unrelated TypeScript or validation discussions.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/boundary-architecture.md (reported line 209)May include surrounding context.

md
})

async function getWeather(city: string) {
  const res = await fetch(`https://api.weather.example/v1/${city}`)
  const json = await res.json()

  // Parse at the boundary — don't trust external data

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.