ClawHub
Back to skill

Security audit

Rapid Prototyper

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent rapid MVP helper, but it encourages unpinned remote tooling, production deployment, and always-on feedback collection without enough safeguards.

Install only if you are comfortable with a speed-first skill that may run package scaffolding, install dependencies, configure external services, push schema changes, collect feedback data, and deploy publicly. Pin package versions, review generated code and lockfiles, avoid global CLI installs, confirm production targets before deploying, and add privacy and server-side validation safeguards before using generated apps with real users or sensitive data.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:44
Finding

Unpinned Third-Party Packages Are Downloaded and Executed

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:44-49, SKILL.md:58; references/stack-setup.md:4-22, references/stack-setup.md:136-140
Vulnerability Type: Supply-chain exposure through mutable and unpinned dependencies
Risk Level: Medium

Vulnerable Code

SKILL.md:44-49:

bash
npx create-next-app@latest my-app --typescript --tailwind --eslint --app
cd my-app
npx shadcn@latest init

SKILL.md:58:

bash
npx vercel --prod

references/stack-setup.md:4-22:

bash
# 1. Create Next.js app
npx create-next-app@latest my-app --typescript --tailwind --eslint --app
cd my-app

# 2. shadcn/ui
npx shadcn@latest init
npx shadcn@latest add button input label card dialog form toast

# 3. Prisma + Supabase
npm install prisma @prisma/client @supabase/supabase-js
npx prisma init

# 4. Clerk auth
npm install @clerk/nextjs

# 5. Zustand + forms
npm install zustand react-hook-form @hookform/resolvers zod

# 6. Optional: Framer Motion
npm install framer-motion

references/stack-setup.md:136-140:

bash
## Deploy to Vercel

```bash
npm install -g vercel
vercel          # preview deploy
vercel --prod   # production deploy

Technical Analysis

Commands such as npx create-next-app@latest and npx shadcn@latest resolve mutable package releases at execution time and immediately run downloaded code. The remaining npm install commands also omit exact versions. Consequently, the effective code executed or installed by the Skill can change after the Skill itself has been reviewed.

npm packages may execute lifecycle scripts during installation. If a referenced package, one of its transitive dependencies, or its publishing account is compromised, a malicious release can execute code with the permissions of the user or agent running these commands. Installing Vercel globally also modifies the user's global tool environment rather than confining the ...[truncated 1573 chars]

Remediation
View remediation

Remediation Suggestions

  1. Replace @latest with exact, reviewed package versions.
  2. Pin all direct dependency versions and commit the generated lockfile.
  3. Use npm ci for repeatable installation after the initial reviewed lockfile has been created.
  4. Avoid global CLI installation. Add Vercel as a version-pinned development dependency and invoke the local binary.
  5. Review transitive dependency changes before updating the lockfile.
  6. Verify package provenance, registry source, integrity metadata, and publisher identity.
  7. Run scaffolding and installation in an isolated, least-privileged environment without production credentials.
  8. Consider initially disabling lifecycle scripts with npm install --ignore-scripts, then explicitly allowing only reviewed scripts where operationally feasible.
  9. Add automated dependency scanning and lockfile integrity checks to the generated project's CI workflow.

T09 · Insecure Skill Coding Practices

Warning
Location
references/patterns.md:18
Finding

API Template Permits Unsafe Mass Assignment of Client-Controlled Fields

Content
View full analysis

Vulnerability Details

File Location: references/patterns.md:18-25
Vulnerability Type: Missing server-side input validation and unsafe mass assignment
Risk Level: Medium

Vulnerable Code

ts
export async function POST(req: Request) {
  const { userId } = auth()
  if (!userId) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })

  const body = await req.json()
  const item = await prisma.item.create({ data: { ...body, userId } })
  return NextResponse.json(item, { status: 201 })
}

Technical Analysis

The route parses an arbitrary JSON body and spreads every supplied property directly into the Prisma create operation. Authentication is present, and the trailing userId assignment prevents the caller from overriding that particular field. However, no server-side schema restricts the remaining properties.

The Zod schema shown elsewhere in the file is applied only through the client-side React form. Client-side validation is not a security boundary because an attacker can call the API directly with a custom HTTP client. Prisma can reject properties that do not exist in the model, but it will accept client-supplied values for writable fields that do exist. As the model evolves, fields such as status, role, approval state, pricing, visibility, moderation state, or other internal attributes could unintentionally become assignable.

The unrestricted body also permits malformed values and oversized or unexpected structures to reach the ORM, potentially causing server errors and unnecessary resource consumption.

Attack Path

  1. An attacker obtains a valid authenticated session, satisfying the Clerk authentication check.
  2. The attacker bypasses the user interface and sends a direct POST request to /api/items.
  3. The request body includes legitimate fields plus a sensitive writable model field omitted from the UI, such as an approval or visibility field.
  4. The route pa ...[truncated 993 chars]
Remediation
View remediation

Remediation Suggestions

  1. Define a strict server-side Zod schema for every API request.
  2. Reject unknown properties with .strict() rather than silently accepting them.
  3. Construct the Prisma data object from an explicit allowlist instead of spreading the request body.
  4. Apply authorization checks separately from syntactic validation for every sensitive operation.
  5. Set ownership, workflow state, approval fields, and other trusted attributes exclusively on the server.
  6. Set a request body size limit and return controlled validation errors.
  7. Add tests that submit unexpected and privileged fields directly to the API.

A hardened implementation would resemble:

ts
const createItemSchema = z.object({
  title: z.string().min(1).max(100),
  description: z.string().max(2000).optional(),
}).strict()

export async function POST(req: Request) {
  const { userId } = auth()
  if (!userId) {
    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
  }

  const input = createItemSchema.parse(await req.json())

  const item = await prisma.item.create({
    data: {
      title: input.title,
      description: input.description,
      userId,
    },
  })

  return NextResponse.json(item, { status: 201 })
}

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (17)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The description says the skill triggers when a user asks to "build," "prototype," "create a quick app," or "wants a working thing fast." Several of these are broad everyday phrases that can overlap with many unrelated coding requests, and the file does not provide a constrained invocation list or negative examples beyond excluding small fixes.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
88% confidence
Finding

The skill instructs users to execute npx create-next-app@latest, which fetches and runs remote package code at the latest available version. This creates a supply-chain risk because behavior can change over time or a compromised upstream package could execute unexpected code during scaffolding.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
90% confidence
Finding

The npx shadcn@latest init command pulls and executes the latest remote code without version pinning. In a speed-focused skill, users are more likely to run it blindly, increasing exposure to supply-chain compromise or breaking changes.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill recommends analytics, feedback collection, and action logging by default without privacy guardrails, consent guidance, retention limits, or warnings against collecting secrets and sensitive personal data. In a rapid-prototyping context, this can normalize unsafe telemetry practices that expose user data or create compliance issues.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
86% confidence
Finding

npx vercel --prod executes an unpinned CLI fetched at runtime, which introduces the same supply-chain and unpredictability risks as other unpinned npx commands. Because it targets production deployment, misuse or compromised tooling could directly affect a live environment.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

Recommending GitHub-triggered auto-deploy for a speed-first MVP can cause unreviewed or insufficiently tested changes to reach a live environment automatically. In combination with the skill's bias toward rapid shipping and skipped edge cases, this increases the chance of exposing insecure code, secrets, or broken access controls in production.

Content

Scanner excerpt · SKILL.md (reported line 67)May include surrounding context.

Phase 5 — Deploy

bash
npx vercel --prod
# or: push to GitHub → auto-deploy on Vercel

Critical Rules

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 73)May include surrounding context.

md
## Critical Rules

- **Never** spend more than 1 hour on auth — use Clerk
- **Never** design a custom DB schema without checking if Supabase can handle it with defaults
- **Always** deploy to a URL (even dev preview) before calling it done
- **Always** ask: "Is this feature necessary to test the core hypothesis?"

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The pattern explicitly says to 'always include' a feedback widget, which normalizes shipping telemetry-like data collection in every MVP regardless of user need. In a rapid-prototyping skill, this is risky because developers may copy it broadly without adding consent, disclosure, retention limits, or backend protections, expanding unnecessary collection of user interaction context.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The example sends free-form feedback together with window.location.href to the server without any user-facing notice about the exact data transmitted. URLs can contain sensitive path segments, query parameters, invite tokens, reset links, or internal identifiers, and free-text feedback can include personal or confidential information, creating avoidable privacy leakage.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
93% confidence
Finding

The snippet sets <html lang="en">, which forces a specific language/locale in the example. The file does not indicate that English is optional, configurable, or required for a region-specific use case.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
75% confidence
Finding

This markdown file instructs users to deploy to Vercel and add environment variables, which can affect production systems and sensitive configuration. The section does not include any explicit warning to verify secrets, production targets, or the impact of running a production deploy.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.