ClawHub
Back to skill

Security audit

Tmp.ChIoCYDxiX

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a legitimate Infinite Campus integration, but it handles sensitive student records while recommending unpinned code execution and persistent school login credentials.

Review this carefully before installing. Use only if you trust the npm package and source repository, avoid project-level config for real credentials, prefer a secret manager or runtime environment variables, pin reviewed versions or commits, and confirm before using tools that read messages or download student documents.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:22
Finding

Unpinned Third-Party Package Retrieval and Execution

Content
View full analysis
Remediation
View remediation
"] ``` - Avoid `npx -y` where possible so installation and execution do not occur automatically without confirmation. - For source installations, check out a reviewed commit hash or signed release rather than the mutable default branch. - Commit and review a dependency lockfile, and use `npm ci` instead of an unconstrained `npm install`. - Verify npm provenance, package integrity, release signatures, and repository ownership before execution. - Audit npm lifecycle scripts and transitive dependencies before exposing the process to credentials. - Run the MCP server under a restricted user or sandbox with access only to the required configuration and network destination. - Establish an upgrade process in which each new version is reviewed before changing the pinned version. ]]>

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:17
Finding

School Account Password Stored in Persistent MCP Configuration

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (4)

MCP Config Access

High
Category
Agent Snooping
Confidence
95% confidence
Finding

Skill accesses MCP server configuration files (mcp.json). MCP configs contain server URLs, authentication tokens, and tool definitions — reading them allows the skill to discover and potentially abuse other tool integrations.

Content

Scanner excerpt · SKILL.md (reported line 17)May include surrounding context.

Option A — npx (recommended)

Add to .mcp.json in your project or ~/.claude/mcp.json:

json
{

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The manifest description says the skill should handle requests like "message the teacher," and the package description says it can "send messages." However, the enumerated tools only expose message listing and reading (ic_list_messages, ic_get_message) plus document access, with no documented tool for composing or sending a message. This is a semantic mismatch between the claimed user-facing capability and the described implemented interface.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger text is broad enough to activate on generic school-related requests such as grades, assignments, attendance, or messaging, even when the user did not explicitly intend to access Infinite Campus. In a skill that handles sensitive student records, overbroad routing can cause unnecessary access to private educational data or invoke actions in the wrong system.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill description advertises access to highly sensitive student information, including messages and downloadable documents, without clearly warning users that these operations involve private educational records. In this context, missing disclosure increases the risk of uninformed consent and accidental exposure of FERPA-sensitive data, especially if the skill is auto-invoked from broad triggers.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.