ClawHub
Back to skill

Security audit

ccdb

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent CCDB lookup guide with disclosed authentication and CLI use, with install-time supply-chain caution but no hidden or destructive behavior found.

Before installing, verify the ccdb-cli package or release source, avoid running the install with elevated privileges, and prefer a reviewed pinned version or checksum-verified binary where possible. Treat CCDB credentials like other account secrets: use secure local configuration, do not paste tokens into chat, and confirm intent before revoking shared authorization.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:17
Finding

Unpinned Global Installation of a Third-Party npm Package

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 17
Vulnerability Type: Insecure third-party dependency installation
Risk Level: Medium

Vulnerable Code

sh
npm install -g ccdb-cli@latest
ccdb-cli --version

Technical Analysis

The Skill instructs users to install ccdb-cli globally using the mutable npm latest distribution tag. This tag does not identify an immutable, previously reviewed release. Consequently, the code installed when the instruction is followed can differ from the code available when the Skill itself was audited.

npm installation can execute package lifecycle scripts, including scripts supplied by the package or its dependency tree. The global installation option also places the CLI in a shared executable location rather than isolating it to the project. Although the Skill requests user consent before installation and recommends checksum verification for standalone binaries, it does not require an exact npm version, package integrity verification, provenance validation, lifecycle-script restrictions, or an isolated installation environment.

This is a supply-chain weakness rather than evidence that the current ccdb-cli package is malicious.

Attack Path

  1. An attacker compromises the npm package publisher, maintainer account, release process, or a transitive dependency.
  2. The attacker publishes a malicious release and assigns it to the latest tag.
  3. A user or agent follows the Skill instruction and runs npm install -g ccdb-cli@latest.
  4. npm downloads the attacker-controlled package or dependency graph and may execute malicious lifecycle scripts during installation.
  5. The malicious package can run with the privileges of the account performing the installation and can replace the globally available ccdb-cli executable.
  6. Subsequent authentication and query commands could invoke the modified CLI, exposing credentials or executing additional attacker-cont ...[truncated 855 chars]
Remediation
View remediation

Remediation Suggestions

  1. Replace the mutable latest tag with an exact, reviewed version, for example:
    sh
    npm install -g ccdb-cli@X.Y.Z
  2. Document the approved version and update it only after reviewing release notes and package provenance.
  3. Require npm package provenance or integrity verification where supported, and verify the package owner, registry, and expected metadata before installation.
  4. Prefer a project-local or otherwise isolated installation over a global installation to reduce executable replacement and cross-project exposure.
  5. Consider disabling lifecycle scripts during acquisition when compatible:
    sh
    npm install --ignore-scripts ccdb-cli@X.Y.Z
    If lifecycle scripts are required, review them before permitting execution.
  6. Do not install with administrator or root privileges unless strictly necessary. Use a restricted account or disposable environment for installation and initial validation.
  7. Apply equivalent checksum and provenance controls to the npm distribution and the standalone binary release.
  8. Continue requiring explicit user approval before installation and avoid automatically upgrading an already installed CLI.

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 82)May include surrounding context.

md
- `invalid_client` 请管理员核对所选环境的客户端登记与启用状态，不自行生成/猜测 client ID。刷新中断时可能已发生 Token 轮换，应重新登录，不重放旧 Refresh Token。
- 当前 CLI 在系统凭证服务不可用且符合自动后备条件时使用本地加密文件，并记住该身份的选择；主密钥也在本机，保护弱于系统钥匙串。后备提示本身不是登录失败。仍报 `CREDENTIAL_STORE_ERROR` 时检查 CLI 版本及错误信息，按 [CLI 说明](https://github.com/carbonstop/ccdb-cli) 处理；不要删除已有凭证文件或主密钥来强制重置。
- 默认 logout 只清理本地凭证；`ccdb-cli auth logout --revoke` 撤销整条应用授权，可能影响共用授权的工具，执行前确认用户意图。它不删除环境 Key，也不在服务端停用 API Key。
- 排错可提供错误码、requestId、HTTP 状态和 Retry-After，不提供 Key、Access Token、Refresh Token 或完整凭证日志。

Static analysis

No suspicious patterns detected.