ClawHub
Back to skill

Security audit

GitHub Trending Report

Security checks for vulnerabilities and agentic risk

Overview

This skill provides straightforward instructions for using a GitHub trending-report CLI, with the main caveat that it asks users to install an unpinned global npm package.

Before installing, consider using a pinned version or a project-local install of github-discover, and review the npm package provenance if you will run it in an environment with sensitive files or credentials.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:8
Finding

Unpinned Global Installation of an Unverified npm Package

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 8 and 65
Vulnerability Type: Unpinned and globally installed third-party dependency
Risk Level: Medium

Vulnerable Code

bash
npm install -g github-discover

The same installation command is presented initially at line 8 and recommended again in the standard workflow at line 65.

Technical Analysis

The skill directs users to install github-discover globally from the npm registry without specifying an exact version, integrity digest, lockfile, verified source repository, or package provenance. Consequently, the installed code depends on whichever package version the registry resolves at installation time rather than the version reviewed when this skill was audited.

npm packages may execute lifecycle scripts during installation. If the package publisher account, release process, or registry artifact is compromised, following this instruction could execute attacker-controlled lifecycle code. The global -g installation also exposes the resulting executable outside an isolated project environment and makes it available to other sessions and projects.

The audited file does not prove that the current package is malicious. The vulnerability is the unsafe and non-reproducible dependency acquisition process.

Attack Path

  1. An attacker compromises the npm package, its publisher account, or its release pipeline and publishes a malicious version.
  2. A user follows the skill documentation and runs npm install -g github-discover.
  3. npm resolves the unpinned package name to the attacker-controlled version.
  4. Malicious npm lifecycle code may execute during installation with the privileges of the installing user.
  5. The globally installed github-discover executable may subsequently execute attacker-controlled behavior whenever the skill invokes it.
  6. Depending on user permissions, the malicious code could access user-readable files, enviro ...[truncated 757 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin the dependency to an exact, reviewed version instead of resolving the latest release:
    bash
    npm install --save-exact github-discover@<reviewed-version>
  2. Prefer a project-local installation over -g and invoke the binary through a package script or a controlled local path.
  3. Commit a lockfile containing npm integrity metadata and use npm ci for reproducible installation.
  4. Verify the package publisher, source repository, release provenance, and npm signatures or attestations before approving a version.
  5. Review the package and its transitive dependencies, including all lifecycle scripts.
  6. Where compatible, install with lifecycle scripts disabled:
    bash
    npm install --ignore-scripts --save-exact github-discover@<reviewed-version>
  7. Perform installation and execution in a sandbox or container with minimal filesystem permissions, no unnecessary credentials, and restricted network access.
  8. Document the approved version and integrity digest in SKILL.md, and require a new security review before updating it.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep