ClawHub
Back to skill

Security audit

builtbyecho-research

Security checks for vulnerabilities and agentic risk

Overview

This research skill is coherent, but it asks agents to run unpinned npm code and includes an external upload workflow without enough user-confirmation and data-handling guardrails.

Install only if you are comfortable running npm-based research tooling with network and browser access. Prefer pinning @builtbyecho/research to the reviewed version, avoid global installs when possible, run it with limited filesystem and environment access, and require an explicit review/redaction step before uploading reports or trace bundles to Vaultline.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:28
Finding

Unpinned Third-Party Package Download and Execution

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 28-46
Vulnerability Type: Unpinned npm dependencies and direct execution of remotely retrieved packages
Risk Level: Medium

Vulnerable Code

bash
npx @builtbyecho/research --help

For repeated use, install globally:

bash
npm install -g @builtbyecho/research
builtbyecho-research --help

Alias:

bash
echo-research --help

Requires Node.js 20+.

Optional browser setup

The package uses Playwright for render/browser escalation. If Playwright browsers are missing, install Chromium:

bash
npx playwright install chromium

Technical Analysis

The Skill instructs the agent to download and execute npm packages without pinning exact versions or verifying package integrity. Although the Skill metadata identifies version 0.5.2, the installation commands do not constrain @builtbyecho/research to that reviewed version.

Running npx @builtbyecho/research can retrieve the current registry version and execute its package code immediately. Similarly, npm install -g can execute npm lifecycle scripts and permanently expose the installed command in the user's global environment. The Playwright command also relies on an unpinned package and downloads a browser binary.

Consequently, the code executed at runtime can differ from the dependency version that was reviewed. A compromised package owner, npm account, registry response, transitive dependency, or future malicious release could introduce arbitrary executable behavior.

Attack Path

  1. An attacker compromises the npm package, a maintainer account, or a transitive dependency, or publishes a malicious future release.
  2. The agent follows the Skill and invokes the unpinned npx or global installation command.
  3. npm downloads the attacker-controlled package version from the registry.
  4. Package lifecycle scripts or the requested executable run under t ...[truncated 925 chars]
Remediation
View remediation

Remediation Suggestions

  • Pin the package to the exact reviewed version, such as:

    bash
    npx --yes @builtbyecho/research@0.5.2 --help

  • Pin Playwright to a reviewed version rather than resolving the latest package implicitly.

  • Prefer a project-local installation governed by a committed lockfile over global installation.

  • Verify registry integrity metadata and dependency provenance before execution.

  • Use npm ci with a reviewed lockfile for repeatable installations.

  • Disable lifecycle scripts with --ignore-scripts where package functionality permits it.

  • Run research tooling in a sandbox or container with restricted filesystem access, minimal environment variables, and limited network permissions.

  • Avoid running npm commands as an administrator or root user.

  • Periodically review both direct and transitive dependencies for ownership changes, vulnerabilities, and unexpected lifecycle scripts.

other

Warning
Location
SKILL.md:121
Finding

Unconfirmed External Upload of Local Research Artifacts

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 121-158
Vulnerability Type: External disclosure of local report or trace content
Risk Level: Medium

Vulnerable Code

markdown
## Vaultline integration

For research that needs durable handoff, upload the final report or trace bundle to Vaultline instead of leaving it in transient chat history.

```bash
node -e '
const fs = require("node:fs");
const { Vaultline } = require("@builtbyecho/vaultline-sdk");
const reportPath = "report.md";
const content = fs.readFileSync(reportPath, "utf8");
const vault = new Vaultline({ apiKey: process.env.VAULTLINE_API_KEY });
vault.files.upload({
  path: `research/${Date.now()}-report.md`,
  content,
  contentType: "text/markdown"
}).then(r => console.log("Vaultline fileId:", r.fileId));
'

Use this pattern when multiple agents or human reviewers need the same source-backed artifact.

text

### Technical Analysis

The integration reads the complete contents of the local `report.md` file and transmits them to the external Vaultline service. The guidance also suggests uploading trace bundles, which may contain more operational detail than a finalized report.

Research artifacts can contain private search queries, internal URLs, proprietary findings, extracted personal information, source text, or operational metadata. The documented workflow does not require the agent to display the selected content, classify it, redact sensitive fields, verify the destination account, or obtain explicit user approval immediately before transfer.

The use of `process.env.VAULTLINE_API_KEY` is preferable to hardcoding a credential, and the code does not place the API key inside the uploaded document. Nevertheless, possession of that key authorizes an external data transfer. Durable third-party storage exceeds the minimum privileges required for local research unless the user specifically requests cross-agent or human-re
...[truncated 1440 chars]
Remediation
View remediation

Remediation Suggestions

  • Make external upload disabled by default and require an explicit user request for each artifact.
  • Before transmission, identify the destination service, account, filename, content type, and expected retention behavior.
  • Present a preview or summary of the information to be uploaded and obtain confirmation immediately before transfer.
  • Scan and redact credentials, tokens, personal information, internal URLs, proprietary content, and unnecessary trace metadata.
  • Restrict uploads to an allowlisted output directory and approved file types rather than accepting arbitrary local paths.
  • Apply file-size limits and reject symbolic links or unexpected filesystem objects.
  • Prefer storing only the finalized report; do not upload full traces unless they are specifically required and separately approved.
  • Document the provider's encryption, access-control, retention, sharing, and deletion policies.
  • Use narrowly scoped API credentials, rotate them regularly, and avoid exposing them to unrelated subprocesses.
  • Retain local storage as the default when durable external handoff is not necessary for the user's requested task.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (12)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The activation description is very broad and can cause the skill to trigger for common research, browsing, installation, verification, and reporting requests. In practice, this increases the chance that agents invoke web-accessing, crawling, or browser-rendering behaviors in situations where the user did not clearly intend those capabilities, expanding attack surface and privacy risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The documentation promotes crawling, JavaScript rendering, scraping fallback behavior, tracing, and external upload to Vaultline without strong user-facing warnings about data collection, retention, and third-party disclosure. In a research skill, this is dangerous because visited pages, extracted content, traces, and generated reports may contain sensitive information that gets stored locally or uploaded externally without adequately informed consent.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The skill instructs users to run npx @builtbyecho/research without pinning an exact version, which causes code to be fetched and executed from the registry at runtime. If the package is updated maliciously, compromised, or a breaking release is published, users may execute unexpected code with local user privileges.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
87% confidence
Finding

The command npx playwright install chromium relies on an unpinned package resolution path and may fetch the latest Playwright package before executing its installer. That creates supply-chain and reproducibility risk because the executed code and downloaded browser artifacts can change over time without review.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

Using npx @builtbyecho/research search ... without a pinned version executes whatever version the npm registry resolves at the time of use. In a research-oriented skill that may be run frequently and on arbitrary prompts, that increases the chance of silent supply-chain compromise or behavior drift.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The unpinned npx @builtbyecho/research fetch ... example allows arbitrary future versions of the package to run when fetching web content. Because this skill handles external data and network access, supply-chain compromise could expose local environment data or alter fetched results.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The render example invokes an unpinned remote package through npx, meaning browser-automation code can change between runs without notice. Since browser-rendering workflows often have broad network and file-system interaction, this magnifies the consequences of a malicious or compromised package release.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The pipeline example uses npx @builtbyecho/research without version pinning, so the code executed for multi-step research can drift or be replaced by a malicious release. Because pipelines may perform search, fetch, render, and tracing, the runtime package has meaningful access to external content and local outputs.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The report-generation example relies on unpinned npx execution, exposing users to supply-chain risk and non-reproducible results. A malicious update could alter citations, exfiltrate traces, or run arbitrary code under the caller's account.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The extraction example executes an unpinned package from npm at runtime, which is a classic supply-chain risk. Since extraction workflows may process sensitive page content or organization data, an attacker controlling a future release could manipulate or leak that data.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

This second extraction example has the same core issue: npx resolves and executes the latest matching package version, not a reviewed immutable artifact. In a skill designed to inspect company sites and contact data, compromise could lead to data exfiltration or deceptive output generation.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The crawl example uses unpinned npx execution for a command that may visit many pages and generate chunked local output. If the package supply chain is compromised, the broader network activity and file handling in crawling make the blast radius larger than a simple read-only utility.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.