Security audit

red-team-pro

Security checks for vulnerabilities and agentic risk

Overview

The skill itself is a coherent Chinese adversarial review workflow, but its README recommends an unpinned npx install command that runs mutable remote code.

Review the skill if you want a Chinese, deliberately adversarial critique style. Prefer a verified or pinned install path over the unversioned npx command, and be aware it may activate for broad requests to find flaws or risks in a plan.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

Location: README.md:28
Finding: Unpinned Third-Party Package Execution via npx## Vulnerability Details **File Location**: `README.md`, line 28 **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: Medium **Vulnerable Code:** ```bash npx @skill-hub/cli install red-team --agent claude clawhub install red-team ``` ### Technical Analysis The installation documentation instructs users to execute `@skill-hub/cli` through `npx` without specifying an exact reviewed version or integrity value. If the package is not already available locally, `npx` can retrieve it from the configured npm registry and immediately execute its code. Because the command references a mutable package name rather than a fixed, verified artifact, the code executed by users may differ from the code that existed when this project was audited. A compromised package release, publishing account, registry configuration, or dependency in the package's transitive dependency graph could introduce malicious installation behavior. This finding concerns the documented installation path. No malicious code was found in the audited project itself. ### Attack Path 1. An attacker compromises the `@skill-hub/cli` package, its publisher account, or a dependency resolved during installation. 2. The attacker publishes a malicious package version under the expected package name. 3. A user follows the installation command in `README.md`. 4. `npx` resolves and downloads the mutable package version from the configured registry. 5. The downloaded package code executes with the operating-system privileges of the user running the command. 6. The malicious package could access or modify any files, credentials, processes, or network resources available to that user. ### Impact Assessment Successful exploitation could provide arbitrary code execution under the invoking user's account. The accessible scope would be limited by that account's privileges and host-level controls, but could include project files, user-readable credentials and c ...[truncated 363 chars]
Remediation: ## Remediation Suggestions - Replace the mutable package reference with an exact, reviewed version, for example `npx @skill-hub/cli@X.Y.Z ...`. - Document the package's official registry and source repository so users can verify provenance. - Publish and verify package integrity metadata or cryptographic signatures where the distribution system supports them. - Review the pinned package and its transitive dependencies before recommending execution. - Use a lockfile and reproducible installation process when integrating the CLI into automated workflows. - Run installation with a minimally privileged account or in an isolated environment without production credentials. - Add a documented upgrade process requiring review before changing the pinned version.

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Natural-Language Policy Violations

Medium

Confidence: 91% confidence
Finding: The skill description and tagline are presented primarily in Chinese, with no indication that other languages are supported or that the user can choose their preferred language. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless clearly documented and justified.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 91% confidence
Finding: The README instructs users to execute `npx @skill-hub/cli install red-team --agent claude` without pinning an exact package version. `npx` resolves and runs the latest published package by default, so a compromised maintainer account, dependency-chain attack, or malicious future release could cause arbitrary code execution on the user's machine at install time. In a skill-distribution context, this is more dangerous because the README is explicitly guiding security-insensitive users to run a remote package directly from the registry.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The trigger conditions are broad enough to match many ordinary requests for feedback, criticism, or risk review, which can cause the skill to activate when the user did not explicitly ask for a formal adversarial workflow. In an agent setting, unintended invocation can override normal assistant behavior, steer tone toward aggressive opposition, and degrade task routing or user trust.

Natural-Language Policy Violations

Medium

Confidence: 90% confidence
Finding: The metadata fixes the skill language to zh-CN without indicating fallback behavior or user choice. In multilingual agent environments, this can lead to responses in an unexpected language, reducing usability, causing misunderstanding of critical feedback, and potentially interfering with safe operation when users cannot accurately interpret the output.

Vague Triggers

Medium

Confidence: 93% confidence
Finding: This markdown file includes an example input that is expected to trigger the skill, but the phrase is a general request about finding flaws in a plan rather than a narrowly scoped invocation. Without explicit constraints or negative examples, the trigger could overlap with ordinary conversation and cause unintended activation.

Static analysis

No suspicious patterns detected.