ClawHub
Back to skill

Security audit

Devvit Publishing Auditor

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent Devvit pre-publishing checklist, but users should be careful with its unpinned npx and publishing-related commands.

Install only if you are comfortable approving Devvit CLI commands in the target project. Prefer using project-local, lockfile-pinned devvit and TypeScript binaries, review any devvit update app changes before committing, and run the upload command only when you intend to publish.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
instructions.txt:9
Finding

Unpinned Third-Party Package Execution Through npx

Content
View full analysis

Vulnerability Details

File Location: instructions.txt, lines 9-12
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code

text
- Request permission to run 'npx devvit whoami' and 'npx devvit version'.
- If version is < 0.12.11, ADVISE the user to run 'npm install -g devvit@latest' manually. Do not run it automatically.
- Suggest running 'npx devvit update app' and wait for user approval.
- Request permission to run 'npx tsc --noEmit' for type checking.

Technical Analysis

The skill instructs the agent to execute devvit and tsc through npx without requiring project-local, lockfile-pinned package versions. If a requested executable is not installed locally, npx may retrieve a package from the npm registry and execute it immediately.

User approval reduces the likelihood of unexpected execution but does not verify package provenance, version, or integrity. The effective code executed by these commands can therefore differ from the code reviewed with the skill. Additionally, npx devvit whoami may access existing Devvit authentication state, while npx devvit update app may modify project files.

The suggested global installation uses the mutable latest tag. Although the skill explicitly says not to run this command automatically, following that recommendation manually would still install an unpinned package globally.

Attack Path

  1. A user invokes the Devvit Publishing Auditor.
  2. The skill requests approval to run one of the unpinned npx commands.
  3. The user approves the command.
  4. The requested executable is missing from the local project or resolves to an unexpected package version.
  5. npx downloads package content from the npm registry.
  6. Package installation hooks or executable code run with the current user's privileges.
  7. A compromised or malicious dependency can read project files and accessible credentials, alter the project, or execute additional system commands.

T ...[truncated 828 chars]

Remediation
View remediation

Remediation Suggestions

  1. Install reviewed versions of devvit and TypeScript as project-local development dependencies and pin them through package.json and a committed lockfile.
  2. Invoke only locally installed binaries, for example:
    bash
    npx --no-install devvit whoami
npx --no-install devvit version
npx --no-install devvit update app
npx --no-install tsc --noEmit
  3. Replace the mutable global-installation recommendation with an exact, reviewed version. Prefer local installation over global installation.
  4. Use reproducible installation commands such as npm ci, with lockfile integrity metadata preserved and reviewed.
  5. Clearly identify whoami as a command that may access authentication state and update app as a command that may modify project files.
  6. Require separate, explicit approval for state-changing operations rather than grouping them with read-only environment checks.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (4)

Rp1

Medium
Category
MCP Rug Pull
Confidence
89% confidence
Finding

This second finding on the same line reflects another unpinned 'npx devvit' invocation. As with the first, executing an unpinned package via npx can fetch and run code that differs from what the user expects, creating a supply-chain execution risk. The surrounding skill context makes this more credible because it explicitly asks the user for permission to run the command.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
92% confidence
Finding

The instruction to suggest 'npx devvit update app' uses an unpinned package and additionally implies a project-modifying operation. If an attacker controls or compromises the resolved package version, this could lead to arbitrary code execution and unintended changes to the repository. Because the command updates the app, the blast radius is higher than a read-only version check.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
85% confidence
Finding

The skill requests permission to run 'npx tsc --noEmit' without pinning the TypeScript package version. Even though '--noEmit' reduces direct project modification, npx may still download and execute an unexpected or malicious package, resulting in arbitrary code execution in the user's environment. This is a classic unpinned tool execution risk.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
90% confidence
Finding

The final recommended upload command, 'npx devvit upload --bump patch', again relies on an unpinned package and performs a publishing action. If the fetched CLI is malicious or changed unexpectedly, it could execute arbitrary code and also affect release artifacts or publish an unintended version. The publish context makes this more dangerous than a purely informational command.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.