red-team-pro

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:05 AM UTC
• Version: 1.0.0

Overview

The skill itself is a coherent Chinese adversarial review workflow, but its README recommends an unpinned npx install command that runs mutable remote code.

Review the skill if you want a Chinese, deliberately adversarial critique style. Prefer a verified or pinned install path over the unversioned npx command, and be aware it may activate for broad requests to find flaws or risks in a plan.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: README.md:28

Finding

Unpinned Third-Party Package Execution via npx

Content

View full analysis

Vulnerability Details

File Location: README.md, line 28
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code:

bash

npx @skill-hub/cli install red-team --agent claude
clawhub install red-team

Technical Analysis

The installation documentation instructs users to execute @skill-hub/cli through npx without specifying an exact reviewed version or integrity value. If the package is not already available locally, npx can retrieve it from the configured npm registry and immediately execute its code.

Because the command references a mutable package name rather than a fixed, verified artifact, the code executed by users may differ from the code that existed when this project was audited. A compromised package release, publishing account, registry configuration, or dependency in the package's transitive dependency graph could introduce malicious installation behavior.

This finding concerns the documented installation path. No malicious code was found in the audited project itself.

Attack Path

1. An attacker compromises the @skill-hub/cli package, its publisher account, or a dependency resolved during installation.
2. The attacker publishes a malicious package version under the expected package name.
3. A user follows the installation command in README.md.
4. npx resolves and downloads the mutable package version from the configured registry.
5. The downloaded package code executes with the operating-system privileges of the user running the command.
6. The malicious package could access or modify any files, credentials, processes, or network resources available to that user.

Impact Assessment

Successful exploitation could provide arbitrary code execution under the invoking user's account. The accessible scope would be limited by that account's privileges and host-level controls, but could include project files, user-readable credentials and c ...[truncated 363 chars]

Remediation

View remediation

Remediation Suggestions

• Replace the mutable package reference with an exact, reviewed version, for example npx @skill-hub/cli@X.Y.Z ....
• Document the package's official registry and source repository so users can verify provenance.
• Publish and verify package integrity metadata or cryptographic signatures where the distribution system supports them.
• Review the pinned package and its transitive dependencies before recommending execution.
• Use a lockfile and reproducible installation process when integrating the CLI into automated workflows.
• Run installation with a minimally privileged account or in an isolated environment without production credentials.
• Add a documented upgrade process requiring review before changing the pinned version.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill description and tagline are presented primarily in Chinese, with no indication that other languages are supported or that the user can choose their preferred language. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless clearly documented and justified.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence

Finding

The README instructs users to execute npx @skill-hub/cli install red-team --agent claude without pinning an exact package version. npx resolves and runs the latest published package by default, so a compromised maintainer account, dependency-chain attack, or malicious future release could cause arbitrary code execution on the user's machine at install time. In a skill-distribution context, this is more dangerous because the README is explicitly guiding security-insensitive users to run a remote package directly from the registry.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger conditions are broad enough to match many ordinary requests for feedback, criticism, or risk review, which can cause the skill to activate when the user did not explicitly ask for a formal adversarial workflow. In an agent setting, unintended invocation can override normal assistant behavior, steer tone toward aggressive opposition, and degrade task routing or user trust.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The metadata fixes the skill language to zh-CN without indicating fallback behavior or user choice. In multilingual agent environments, this can lead to responses in an unexpected language, reducing usability, causing misunderstanding of critical feedback, and potentially interfering with safe operation when users cannot accurately interpret the output.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This markdown file includes an example input that is expected to trigger the skill, but the phrase is a general request about finding flaws in a plan rather than a narrowly scoped invocation. Without explicit constraints or negative examples, the trigger could overlap with ordinary conversation and cause unintended activation.

Content

No source excerpt is available for this finding.