ClawHub
Back to skill

Security audit

FastMode CMS - Host, Deploy, Manage Websites for Free

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly coherent for managing FastMode websites, but it deserves review because it installs an unpinned external CLI that uses persistent OAuth access for live site and client-management actions.

Review the npm package provenance before installing, prefer a pinned or verified fastmode-cli version, and only use this skill in an environment where persistent FastMode OAuth credentials are acceptable. Confirm the exact project, content to be published, deployment target, and any client invite permissions before running commands that create, deploy, invite, grant DNS/API/billing access, or publish content.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:4
Finding

Unpinned Third-Party CLI Dependency with Access to Credentials and Cloud Resources

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:4
Vulnerability Type: Unpinned executable dependency
Risk Level: Medium

Vulnerable Code Snippet:

yaml
metadata: {"openclaw":{"emoji":"⚡","homepage":"https://fastmode.ai","requires":{"bins":["fastmode"]},"install":[{"id":"npm","kind":"npm","package":"fastmode-cli","bins":["fastmode"]}]}}

Technical Analysis

The Skill declares fastmode-cli as an npm-installed executable without specifying an exact version or an integrity digest. Consequently, installation may resolve to mutable package content published after this Skill was reviewed.

The project contains only SKILL.md; it does not include the executable implementation of the CLI. The audit therefore cannot verify how the dependency handles local files, OAuth tokens, network requests, or authenticated cloud operations. This is particularly significant because the documented CLI persists OAuth credentials in ~/.fastmode/credentials.json, uploads deployment archives, and can perform project management, CMS modification, client invitation, DNS, API, and billing-related operations.

This is a supply-chain weakness rather than evidence that the current npm package is malicious. Exploitation requires compromise of the package, its publisher account, the npm distribution path, or publication of an unsafe future release.

Attack Path

  1. An attacker compromises the fastmode-cli npm package, its maintainer account, or another component of its release process.
  2. The attacker publishes a modified package version containing malicious installation-time or runtime behavior.
  3. Because the Skill does not pin a reviewed version and integrity value, a subsequent installation resolves to the compromised release.
  4. The installed fastmode executable runs with the privileges of the user or Agent invoking it.
  5. The malicious executable can attempt to read accessible local data, including the documented F ...[truncated 897 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin fastmode-cli to an exact, security-reviewed version rather than allowing installation of an unspecified release.
  2. Require verification against an expected package integrity digest or trusted lockfile.
  3. Publish or vendor the corresponding CLI source so its credential access, network destinations, installation hooks, and command execution behavior can be audited.
  4. Use reproducible builds and signed release artifacts, and document how signatures are verified before execution.
  5. Review dependency updates before changing the pinned version, including transitive dependencies and npm lifecycle scripts.
  6. Run the CLI with the minimum necessary filesystem and network privileges. Restrict access to unrelated credentials and sensitive files.
  7. Keep FastMode OAuth scopes limited to required project operations and provide straightforward token revocation and rotation procedures.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
Findings (15)

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 46)May include surrounding context.

This is the complete sequence to go from nothing to a live website.

bash
# 1. Authenticate (one-time — credentials persist at ~/.fastmode/credentials.json)
fastmode login

# 2. Create a project (gets a free hosted URL instantly)

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 140)May include surrounding context.

This is the complete sequence to go from nothing to a live website.

bash
# 1. Authenticate (one-time — credentials persist at ~/.fastmode/credentials.json)
fastmode login

# 2. Create a project (gets a free hosted URL instantly)

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 146)May include surrounding context.

This is the complete sequence to go from nothing to a live website.

bash
# 1. Authenticate (one-time — credentials persist at ~/.fastmode/credentials.json)
fastmode login

# 2. Create a project (gets a free hosted URL instantly)

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 149)May include surrounding context.

This is the complete sequence to go from nothing to a live website.

bash
# 1. Authenticate (one-time — credentials persist at ~/.fastmode/credentials.json)
fastmode login

# 2. Create a project (gets a free hosted URL instantly)

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 1445)May include surrounding context.

This is the complete sequence to go from nothing to a live website.

bash
# 1. Authenticate (one-time — credentials persist at ~/.fastmode/credentials.json)
fastmode login

# 2. Create a project (gets a free hosted URL instantly)

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 793)May include surrounding context.

md
<head>
  <meta charset="UTF-8">
  <meta name="viewport" content="width=device-width, initial-scale=1.0">
  <!-- SEO managed by Fast Mode — do not add title, description, or OG tags -->
  <link rel="stylesheet" href="/public/css/style.css">
  <!-- External fonts, scripts, etc. are fine -->
  <link href="https://fonts.googleapis.com/css2?family=Inter:wght@400;600&display=swap" rel="stylesheet">

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 832)May include surrounding context.

{{{body}}}
{{{bio}}}
{{body}}
```

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 898)May include surrounding context.

Conditionals — {{#if}}, {{#unless}}

html
<!-- Show if field has a value -->
{{#if image}}
  <img src="{{image}}" alt="{{name}}">
{{/if}}

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 924)May include surrounding context.

md
<span class="badge">Published</span>
{{/if}}

<!-- Not equal — useful for "Related Items" excluding current item -->
{{#unless (eq slug ../slug)}}
  <a href="{{url}}">{{name}}</a>
{{/unless}}

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 1008)May include surrounding context.

Without data-edit-key attributes, static pages have NO editable content in the CMS dashboard. Every text element that should be editable MUST have one.

html
<!-- Static pages — REQUIRED for editable content -->
<h1 data-edit-key="home-hero-title">Welcome to Our Site</h1>
<p data-edit-key="home-hero-subtitle">We build amazing things.</p>
<p data-edit-key="home-about-text">Our story began in 2020...</p>

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The top-level description strongly promotes creating and deploying a website 'for free' and hosting it publicly, but it omits an equally prominent warning that deployment exposes content to the public internet. For an autonomous or semi-autonomous agent, this increases the risk of publishing sensitive, unfinished, or user-unapproved content.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
83% confidence
Finding

The skill explicitly emphasizes one-time browser login followed by persistent terminal-based operation, which encourages long-lived authenticated sessions for powerful project-management and deployment actions. In an agent environment, persistent authenticated state increases the blast radius of mistakes or prompt-triggered misuse because later commands can execute without renewed user presence.

Content

Scanner excerpt · SKILL.md (reported line 10)May include surrounding context.

md
# FastMode CLI — Complete Agent Reference

FastMode lets you create a live website, deploy it to the cloud, and manage all its content — entirely from the command line. One-time browser login for OAuth authentication, then every operation runs in the terminal. No local servers, no manual dashboards.

- **Free cloud hosting** — every site gets a live URL at `yoursite.fastmode.ai`
- **Free SSL** — HTTPS included automatically

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The skill documents client invitation and permission-management flows that can grant external users access to CMS, DNS, API, forms, and billing capabilities, but it does not consistently emphasize least-privilege selection or the security consequences of sharing invite URLs. In an agent context, this can normalize granting broad access to third parties without adequate user confirmation or risk disclosure.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
90% confidence
Finding

Automatic token refresh backed by a stored refresh token means the skill can maintain access over time without repeated user interaction. That is not inherently malicious, but in a user-invokable agent skill it materially increases the risk of unauthorized follow-on actions if the agent is tricked, misdirected, or used by someone with access to the environment.

Content

Scanner excerpt · SKILL.md (reported line 146)May include surrounding context.

md
- `login` uses OAuth 2.0 device authorization flow: opens a browser window where the user approves access on `fastmode.ai`, then credentials are saved automatically. The browser is only needed for this one-time login step.
- **OAuth scopes:** The token grants access to the user's FastMode projects only (project management, schema editing, content CRUD, deployments). No third-party service access is requested.
- Credentials persist at `~/.fastmode/credentials.json` with restricted file permissions (`0o600` — owner read/write only). Treat this file as a sensitive secret.
- Tokens auto-refresh. If a token expires, the next command will refresh it silently using the stored refresh token.
- If credentials are missing or invalid, most commands will trigger the login flow automatically.
- `logout` deletes `~/.fastmode/credentials.json` and revokes the stored tokens.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 1310)May include surrounding context.

md
### 9. Deploy blocked by GitHub

**Problem:** `deploy` refuses to upload, says GitHub is connected.
**Cause:** Project has GitHub auto-deploy enabled.
**Fix:** Use `--force` flag: `fastmode deploy site.zip --force`.

### 10. Build fails after deploy

Static analysis

No suspicious patterns detected.