ClawHub
Back to skill

Security audit

🦄 Unicon CLI

Security checks for vulnerabilities and agentic risk

Overview

The skill is mainly an icon-management helper, but it needs review because it installs mutable third-party code globally and documents commands that can persistently overwrite AI assistant rule files.

Review the npm package source or pin an exact trusted version before installing, avoid global or unpinned `npx` execution in sensitive projects, and do not run `unicon skill --all` or `--force` unless you have reviewed the files it will write and have backups. Treat API-returned SVG as untrusted markup and sanitize it before rendering in an application.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:26
Finding

Execution of an Unpinned Third-Party npm Package

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
references/api-reference.md:223
Finding

Unsanitized Remote SVG Content Rendered Through dangerouslySetInnerHTML

Content
View full analysis
); } ``` ### Technical Analysis The documented component passes `icon.content`, obtained from the remote Unicon API, directly to React's `dangerouslySetInnerHTML`. No sanitization, schema validation, element allowlist, or attribute allowlist is applied before the browser interprets the value as SVG markup. SVG is an active markup format and can contain security-sensitive constructs, including event-handler attributes, links, external-resource references, animation elements, and foreign content. Although browser behavior and Content Security Policy can limit particular payloads, treating remote SVG fragments as trusted HTML creates a DOM-injection boundary. The example may be copied into applications under the assumption that API responses are safe. If the API, its icon ingestion pipeline, an upstream icon source, DNS/transport trust, or a configurable API endpoint is compromised, malicious content could reach the application DOM. ### Attack Path 1. An attacker gains influence over an icon record returned by the API, such as through compromise of the API, its data pipeline, or an upstream icon source. 2. The attacker places active SVG markup or a malicious attribute in the icon's `content` field. 3. An application fetches the affected icon using the documented API. 4. The application passes the API object to the documented `Icon` component. 5. `dangerouslySetInnerHTML` inserts the attacker-controlled markup into the SVG DOM without val ...[truncated 878 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • Rogue AgentSelf-Modification, Session Persistence
Findings (12)

Unvalidated Output Injection

High
Category
Output Handling
Confidence
99% confidence
Finding

The example injects icon.content directly into the DOM via dangerouslySetInnerHTML, which is a classic unsafe sink. Because content is documented as raw SVG inner content received from an external API, any malicious or unexpected markup in that field could lead to XSS, DOM injection, or abuse of SVG features in downstream applications.

Content

Scanner excerpt · references/api-reference.md (reported line 222)May include surrounding context.

md
return (
    <svg
      viewBox={icon.viewBox}
      dangerouslySetInnerHTML={{ __html: icon.content }}
      fill={icon.defaultFill ? "currentColor" : "none"}
      stroke={icon.defaultStroke ? "currentColor" : "none"}
      strokeWidth={icon.strokeWidth ?? 2}

Self-Modification

High
Category
Rogue Agent
Confidence
87% confidence
Finding

The documented ability to overwrite existing IDE skill files is a form of self-modification of agent-governing artifacts. In the skill context this is especially dangerous because changing .claude, .cursor, .codex, or similar rule files can persistently influence assistant behavior, potentially enabling prompt injection persistence or weakening future security controls.

Content

Scanner excerpt · references/cli-commands.md (reported line 379)May include surrounding context.

md
| `-l, --list` | List supported assistants |
| `--ide <name>` | Install for specific IDE |
| `--all` | Install for all supported IDEs |
| `-f, --force` | Overwrite existing files |

**Supported IDEs:**

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 225)May include surrounding context.

md
| IDE | Directory |
|-----|-----------|
| Claude Code | `.claude/skills/unicon/SKILL.md` |
| Cursor | `.cursor/rules/unicon.mdc` |
| Windsurf | `.windsurf/rules/unicon.md` |
| Agent | `.agent/rules/unicon.md` |

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api-reference.md (reported line 63)May include surrounding context.

bash
# Search with AI
curl "https://unicon.sh/api/icons?q=dashboard"

# Filter by source
curl "https://unicon.sh/api/icons?q=arrow&source=lucide"

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The API reference returns raw SVG inner content in the content field and later demonstrates rendering it with React's dangerouslySetInnerHTML without any warning or sanitization guidance. If icon data is ever compromised, user-supplied, proxied from third parties, or includes unsafe SVG constructs, consumers may introduce XSS or scriptable SVG injection into their apps.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The unicon init --force examples describe overwriting an existing config file, but the documentation does not explicitly warn that existing .uniconrc.json content may be replaced. Markdown guidance for file-modifying or destructive operations should disclose the risk to user data or configuration.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The unicon skill command enables writing AI assistant rule/skill files into multiple IDE-specific directories, which is outside the core icon-search and icon-bundling purpose described for the tool. In a skill context, this is more dangerous because it modifies trusted prompt/configuration surfaces that can influence future agent behavior across developer tools.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill installation --force option can overwrite existing IDE skill/rule files in trusted locations without an explicit warning in the docs. In this context, overwriting agent instruction files is more sensitive than replacing ordinary generated assets because it can alter how coding assistants behave in future sessions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill instructs users to install assistant integrations into local rule/skill directories, which modifies editor or agent configuration in the user's environment, but it does not clearly warn about that side effect. This can lead users to alter trusted automation or prompt-routing behavior without understanding the persistence and scope of the change.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

This markdown file documents unicon cache --clear as clearing all cached icons, but it does not include any cautionary wording about deleting local cache contents. For markdown files, destructive behavior that affects local user data should be accompanied by a warning so users understand the impact before running the command.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.