ClawHub
Back to skill

Security audit

NPkill

Security checks for vulnerabilities and agentic risk

Overview

This is a straightforward developer cleanup skill, with disclosed but real risks around bulk deletion and global package installation.

Install only if you are comfortable trusting npkill from your npm registry. Prefer dry-run and interactive mode, run from a narrow development workspace, and avoid --delete-all --yes unless you have reviewed the matched paths and can recreate the deleted folders.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:103
Finding

Unpinned Global Installation of a Third-Party npm Package

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 103-106
Vulnerability Type: Unpinned third-party dependency installed globally
Risk Level: Medium

Vulnerable Code Snippet:

markdown
## Installation Requirements

This skill requires the npkill CLI tool to be installed globally:
```bash
npm install -g npkill
text

### Technical Analysis

The installation command does not specify an exact version, integrity hash, lockfile, or other provenance control. It therefore resolves the mutable latest version of `npkill` from the configured npm registry at installation time.

npm installation can execute package lifecycle scripts, while the global installation option exposes the installed executable throughout the user's environment. If a future package release, transitive dependency, npm registry response, or configured registry is compromised, following this instruction could install and execute code that was not included in the reviewed Skill.

The installed utility is subsequently trusted to scan directories and perform recursive deletion. Although no malicious behavior is present in the audited file itself, relying on an unpinned globally installed package creates a supply-chain risk.

### Attack Path

1. An attacker compromises a future `npkill` release, one of its transitive dependencies, or the npm registry configured on the victim's system.
2. The victim follows the documented `npm install -g npkill` instruction.
3. npm resolves and downloads the attacker-controlled package version because no exact version or integrity constraint is specified.
4. Malicious code executes through an installation lifecycle script or when the globally installed `npkill` command is invoked.
5. The code runs with the privileges of the user executing npm and can access resources available to that account. If installation is performed with administrative privileges, the resulting impact may be correspondingly greater.
...[truncated 513 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin npkill to an explicitly reviewed version rather than installing the mutable latest release.
  2. Record and verify the expected package integrity hash and trusted npm registry.
  3. Prefer a project-local, lockfile-controlled dependency over global installation.
  4. Install and execute the package without administrative privileges.
  5. Review the pinned package, transitive dependency tree, and lifecycle scripts before use.
  6. Retain the documented dry-run and interactive review steps before permitting deletion.
  7. Periodically reassess the pinned version and update it only after security review.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
91% confidence
Finding

The skill explicitly presents a fully non-interactive destructive command (npkill --delete-all --yes) that enables autonomous bulk deletion of directories without per-item user confirmation. Although the stated purpose is workspace cleanup and the surrounding text advises caution and dry-run first, an agent following this skill could still remove large amounts of project state automatically, causing data loss or disruption if run from an overly broad directory or in an unexpected environment.

Content

Scanner excerpt · SKILL.md (reported line 47)May include surrounding context.

bash
npkill --delete-all --yes

Automatically deletes all node_modules folders found. Use only after verifying with dry-run.

View Sizes in Gigabytes

bash

Static analysis

No suspicious patterns detected.