ClawHub
Back to skill

Security audit

Synapse Wiki

Security checks for vulnerabilities and agentic risk

Overview

Synapse Wiki is a disclosed local knowledge-base skill that writes only user-directed wiki files and install files, with no evidence of hidden exfiltration or deceptive behavior.

Install only from a source you trust, review the unpinned npx examples before copying them, and be aware that installation modifies ~/.claude/skills while wiki use creates persistent files under the wiki root you provide.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
RELEASE.md:68
Finding

Unpinned Remote Package Execution and Skill Installation

Content
View full analysis

Vulnerability Details

File Location: RELEASE.md:68-72
Vulnerability Type: Unpinned third-party package execution and mutable supply-chain installation
Risk Level: Medium

Complete Code Snippet:

bash
### Method 2: Install from ClawHub
```bash
npx clawhub install synapse-brain
npx clawhub install synapse-code
npx clawhub install synapse-wiki
text

### Technical Analysis

The documented installation commands invoke `clawhub` through `npx` without specifying an immutable package version, lockfile, integrity hash, signature, or verified publisher scope. `npx` may download and execute the package version resolved by the npm registry at installation time. The invoked CLI then installs additional remotely resolved skills by mutable names.

Consequently, the effective code executed by users can differ from the code reviewed in this audit. This creates a supply-chain trust boundary in which compromise, publisher-account takeover, package substitution, or a malicious future release of either the CLI or a named skill could introduce arbitrary behavior.

The repository itself does not contain a demonstrated malicious payload, and its executable scripts do not perform remote retrieval. The risk arises specifically when users follow these remote installation instructions.

### Attack Path

1. An attacker compromises or takes control of the npm package resolved as `clawhub`, its publisher account, or the distribution source for one of the named skills.
2. The attacker publishes a malicious version under the same mutable package or skill name.
3. A user follows the instructions in `RELEASE.md` and runs an unpinned `npx clawhub install ...` command.
4. `npx` resolves, downloads, and executes the package available at that time.
5. The compromised CLI or remote skill installer executes malicious installation logic with the invoking user's permissions.
6. The malicious package can access or modify resources a
...[truncated 612 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin the clawhub CLI to a reviewed, immutable version, for example through an exact version rather than a floating package name.
  2. Pin every installed skill to an explicit reviewed version or, preferably, an immutable content digest or commit.
  3. Publish and verify cryptographic checksums or signatures before installation.
  4. Use a verified publisher scope and clearly document the authoritative registry and repository identities.
  5. Use a lockfile where npm-based tooling is required, and enforce integrity metadata during installation.
  6. Avoid direct execution through unpinned npx; install a verified version first and invoke that known local binary.
  7. Run installation in a restricted environment with least privilege and review downloaded installation content before execution.
  8. Standardize the repository identity across documentation. README.md references github.com/ankechenlab/synapse-wiki, while SKILL.md and release material reference github.com/ankechenlab-node/synapse-wiki. Users should be directed to one verified authoritative source.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (28)

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The documented behavior includes installation and filesystem-copy operations under ~/.claude/skills that are not clearly reflected in the high-level purpose statement. This mismatch can mislead users into authorizing a 'wiki' skill that also modifies agent configuration or skill directories, which is a trust and transparency failure with security consequences.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
92% confidence
Finding

The documented behavior includes installation and filesystem-copy operations under ~/.claude/skills that are not clearly reflected in the high-level purpose statement. This mismatch can mislead users into authorizing a 'wiki' skill that also modifies agent configuration or skill directories, which is a trust and transparency failure with security consequences.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The documented behavior includes installation and filesystem-copy operations under ~/.claude/skills that are not clearly reflected in the high-level purpose statement. This mismatch can mislead users into authorizing a 'wiki' skill that also modifies agent configuration or skill directories, which is a trust and transparency failure with security consequences.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

The documented behavior includes installation and filesystem-copy operations under ~/.claude/skills that are not clearly reflected in the high-level purpose statement. This mismatch can mislead users into authorizing a 'wiki' skill that also modifies agent configuration or skill directories, which is a trust and transparency failure with security consequences.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The primary description and usage context are presented in Chinese, and the README does not indicate that users may choose another language or that the skill is intended only for a Chinese-specific environment. This is a natural-language locale policy concern because it implicitly constrains interaction language without opt-in.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
85% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 31)May include surrounding context.

cd synapse-wiki ./install.sh

方式 2：手动复制到 Claude skills

cp -r synapse-wiki ~/.claude/skills/

text

Rp1

Medium
Category
MCP Rug Pull
Confidence
90% confidence
Finding

The release notes instruct users to run npx clawhub install synapse-brain without pinning a specific package or tool version. This creates a supply-chain risk: users may fetch whatever version is current at execution time, and if the registry, package owner, or dependency chain is compromised, malicious code could be installed or executed. In a skill installation context, this is more dangerous because the command is presented as a recommended setup path and is likely to be copied verbatim by users.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
90% confidence
Finding

The command npx clawhub install synapse-code references an unpinned package execution path, so the actual code run depends on the latest published registry state at install time. That enables dependency confusion, malicious update, or account-compromise scenarios that can lead to arbitrary code execution during installation. Because this file is a release/install document, the unsafe pattern directly influences user behavior and increases practical exploitability.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
90% confidence
Finding

The instruction npx clawhub install synapse-wiki executes tooling and retrieves artifacts without a pinned version, exposing users to upstream package changes or compromise. If exploited, an attacker could deliver a trojaned installer or altered dependency set, resulting in code execution on the user's machine. The skill context makes this moderately dangerous because the command appears in official installation guidance for a developer-oriented tool, where copy-paste execution is common.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding

The skill advertises operations that read and write arbitrary local files and invoke shell-oriented installation commands, but it does not declare any explicit tool scope or permission boundaries. In an agent environment, missing scope declarations can cause the skill to be invoked with broader filesystem or shell access than users expect, increasing the chance of unintended file modification or command execution.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The activation guidance uses broad everyday triggers like 'wiki', 'knowledge base', 'query knowledge', and 'organize documents' without strong limits. In agent orchestration, overly broad triggers can cause the skill to auto-activate in contexts the user did not intend, leading to unnecessary access to documents, ingestion of sensitive material, or writes to persistent storage.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The script’s user-facing title, usage, help text, and most status/output messages are written in Chinese, which imposes a specific language on users by default. Under the policy, language constraints should either be optional/opt-in or clearly justified as region-specific, neither of which is present here.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
85% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · install.sh (reported line 101)May include surrounding context.

sh
if [[ ! -d "$HOME/.claude/skills" ]]; then
        log_info "Creating Claude skills directory..."
        if [[ "$DRY_RUN" == false ]]; then
            mkdir -p "$HOME/.claude/skills"
            log_success "Created: $HOME/.claude/skills"
        else
            log_info "[DRY-RUN] Would create: $HOME/.claude/skills"

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The module docstring describes the workflow as validating the index, reading pages, and synthesizing/saving an answer, but the overall file is presented as a query operation and the function documentation centers on querying the knowledge base. In code, every query also creates or modifies files under outputs/queries, making this command state-changing rather than purely read/query behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This code file contains natural-language strings in Chinese for the module description, usage text, and later user-facing messages, but does not indicate that the skill is region-specific or provide an opt-in language choice. Under the policy rule, forcing a specific language/locale without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · tests/baseline_test.py (reported line 32)May include surrounding context.

python
def run_script(script_path, args):
    """Run a Python script and return result."""
    try:
        result = subprocess.run(
            ['python3', str(script_path)] + args,
            capture_output=True,
            text=True,

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

This Python file contains natural-language instructions and user-facing test descriptions in Chinese, including the module docstring and many status messages, but does not indicate that the skill is region-specific or provide any user opt-in for language selection. Under the language/locale policy, forcing a specific language in natural-language content without choice or justification is a policy concern.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · tests/integration_test.py (reported line 33)May include surrounding context.

python
def run_script(script_path, args, timeout=60):
    """Run a Python script and return result."""
    try:
        result = subprocess.run(
            ['python3', str(script_path)] + args,
            capture_output=True,
            text=True,

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

This markdown file contains substantial user-facing natural-language content in Chinese across many entries, while there is no indication that the skill is intentionally region-specific or that users can choose their preferred language. Under the policy rule for language/locale constraints, forcing a specific language without opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

This markdown file uses Chinese throughout, including the title, section headings, and content, with no indication that the skill is region-specific or that users may choose another language. Under the policy rule, forcing a specific language without opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
87% confidence
Finding

The manifest description and trigger guidance are presented in Chinese, which implicitly fixes the skill's operating language for user-facing instructions. There is no indication that users may choose another language or that the locale restriction is intentional and justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The _comment field is written entirely in Chinese and provides the primary human-readable setup instruction. This imposes a specific language on users without any opt-in or alternative locale, which matches the language/locale policy concern for natural-language content.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
96% confidence
Finding

The module docstring presents the script name, purpose, and usage entirely in Chinese, which imposes a specific language on users rather than offering a locale choice. The same pattern continues in the CLI help strings, making the skill's user-facing interface language-specific without opt-in or justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The argparse description and argument help strings are user-facing natural-language output and are fixed to Chinese. This is a locale policy issue because users are not given a language choice or any documented reason for the restriction.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
96% confidence
Finding

This code file contains user-facing natural-language text exclusively in Chinese in the module docstring and command description, which implies a fixed language/locale for the skill. The policy allows locale constraints only when user choice or a justified region-specific constraint is provided, neither of which appears here.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.