ClawHub
Back to skill

Security audit

unifi-cli

Security checks for vulnerabilities and agentic risk

Overview

This UniFi helper is purpose-aligned, but it tells the agent to install and link an unpinned third-party CLI from GitHub before using sensitive local network credentials.

Review the referenced UniFi CLI source before installing, prefer a pinned commit or signed release if available, and run installation with minimal exposed secrets. Use a UniFi API key with only the permissions you need, and only approve restart or power-cycle commands when you intend to disrupt that network device.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:13
Finding

Unpinned Third-Party CLI Installation Creates a Supply-Chain Execution Risk

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 13–16
Vulnerability Type: Unpinned third-party repository and dependency installation
Risk Level: Medium

Complete Code Snippet:

markdown
If it isn't installed, install it (requires [Bun](https://bun.sh)):

    git clone https://github.com/baileywickham/unifi-cli
    cd unifi-cli && bun install && bun link

Technical Analysis

The installation instructions clone the current state of a third-party GitHub repository without pinning it to a reviewed commit hash or an immutable, verified release. The subsequent bun install operation resolves and installs third-party packages and may execute package lifecycle scripts. Finally, bun link exposes the installed CLI through the user's executable search environment.

Because neither the repository revision nor the resolved dependency set is constrained in the Skill instructions, the code executed during installation can change after this Skill has been audited. A compromise of the referenced repository, its publishing account, or one of its dependencies could therefore introduce attacker-controlled code.

This is primarily an insecure dependency and software supply-chain issue. It also has characteristics of remote payload retrieval because the effective executable payload is downloaded from a mutable external source.

Attack Path

  1. An attacker compromises the referenced GitHub repository, a maintainer account, or a dependency resolved by Bun.
  2. The attacker adds malicious installation/runtime code or publishes a compromised dependency version.
  3. A user or agent follows the documented installation procedure.
  4. git clone retrieves the mutable, attacker-controlled repository content.
  5. bun install installs the compromised dependency graph and may execute malicious lifecycle scripts.
  6. bun link makes the compromised unifi executable available for subsequent truste ...[truncated 1069 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin the repository to a specific, reviewed commit hash or a signed immutable release instead of cloning the repository's current default branch.
  2. Publish and verify a cryptographic checksum or signature for the approved source archive and installation artifacts.
  3. Commit a dependency lockfile and require frozen or immutable dependency resolution during installation.
  4. Audit direct and transitive dependencies before approving the pinned release.
  5. Disable package lifecycle scripts during dependency installation where operationally feasible; otherwise, explicitly review every script that can run.
  6. Require explicit user approval before cloning repositories, installing packages, executing installation scripts, or linking executables.
  7. Run installation and initial verification in a restricted environment with minimal filesystem permissions, no unnecessary secrets in environment variables, and constrained network access.
  8. Document the exact approved release, commit identifier, expected checksum, and verification commands directly in SKILL.md.
  9. Prefer a reproducible, signed distribution mechanism over installing directly from a mutable source repository.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep