ClawHub
Back to skill

Security audit

Chen Find Skills

Security checks for vulnerabilities and agentic risk

Overview

This skill is meant to find and install other skills, but it can steer ordinary help requests into running unpinned remote install commands that modify the user's global agent environment.

Review this skill carefully before installing. It is not deceptive or destructive on its face, but it encourages agents to run live `npx` commands and install third-party skills globally with confirmation skipped. Prefer pinned or preinstalled tooling, inspect any skill source before installing, avoid `-y`, and use global installs only when you intentionally want the skill to affect future sessions.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:23
Finding

Unpinned Third-Party CLI Enables Unattended Global Skill Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:23-32, SKILL.md:48-50, and SKILL.md:87-95
Vulnerability Type: Unpinned dependency execution and unsafe third-party skill installation
Risk Level: Medium

Vulnerable Code

SKILL.md:23-32:

markdown
The Skills CLI (`npx skills`) is the package manager for the open agent skills ecosystem. Skills are modular packages that extend agent capabilities with specialized knowledge, workflows, and tools.

**Key commands:**

- `npx skills find [query]` - Search for skills interactively or by keyword
- `npx skills add <package>` - Install a skill from GitHub or other sources
- `npx skills check` - Check for skill updates
- `npx skills update` - Update all installed skills

**Browse skills at:** https://skills.sh/

SKILL.md:48-50:

bash
npx skills find [query]

SKILL.md:87-95:

markdown
### Step 4: Offer to Install

If the user wants to proceed, you can install the skill for them:

```bash
npx skills add <owner/repo@skill> -g -y

The -g flag installs globally (user-level) and -y skips confirmation prompts.

text

### Technical Analysis

The Skill directs the agent to execute `npx skills` without pinning the CLI package to an audited version or integrity-verified artifact. Depending on the local npm configuration and cache state, `npx` can retrieve and execute the package currently resolved under the `skills` name. The executed implementation can therefore differ from the implementation reviewed when this Skill was published.

The workflow also allows skills discovered through external search results to be installed from GitHub or other sources. It does not require verification of repository ownership, release signatures, commit hashes, package contents, or integrity metadata. The documented installation command combines global user-level installation (`-g`) with confirmation suppression (`-y`), removing an i
...[truncated 1834 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin the CLI to a reviewed version, for example by using an explicitly approved version rather than an unqualified npx skills invocation.
  2. Enforce package-lock or integrity verification where supported, and obtain packages only from an approved registry.
  3. Restrict installable skills to an allowlist of trusted owners, repositories, releases, and immutable commit hashes.
  4. Inspect downloaded skill contents, including scripts, hooks, dependencies, and instruction files, before installation.
  5. Remove -y so that installation cannot proceed without a final interactive confirmation.
  6. Require explicit user approval immediately before installation and clearly disclose the source, reviewed revision, and destination.
  7. Default to project-local installation instead of global installation. Use global scope only when the user explicitly requests it and understands the broader impact.
  8. Avoid automatic bulk updates. Review changes and provenance before running skills update.
  9. Execute third-party installation tooling in a restricted environment with minimal filesystem, credential, and network access.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (17)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The top-level description is broad enough to match many ordinary requests for help or capability questions, which can cause this skill to activate in conversations where the user did not ask to search for or install third-party software. In this skill's context, over-triggering is security-relevant because activation leads quickly to commands that fetch and install remote code.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The listed activation conditions are ambiguous and overlap with normal assistance requests like 'how do I do X' or 'can you do X'. Because the skill then steers toward third-party skill discovery and installation, these broad triggers can unexpectedly transition a benign support interaction into a software acquisition workflow with supply-chain risk.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The skill repeatedly instructs use of npx skills without pinning a package version or otherwise constraining the package source. Because npx fetches and executes remote code, a compromised or newly changed upstream package could execute arbitrary code in the user's environment when searching, installing, checking, or updating skills.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

This command example uses npx skills find [query] without a pinned version, causing the agent or user to execute whatever package version is current at runtime. If the package or its dependencies are hijacked, the search command becomes a remote code execution path even before any explicit installation decision is made.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The skill recommends npx skills add <package> without version pinning the CLI itself, so the package manager code being executed is mutable and fetched live. Since this command installs additional code from GitHub or other sources, the unpinned bootstrap layer compounds supply-chain risk and broadens the blast radius.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
94% confidence
Finding

npx skills check executes an unpinned remote package to inspect updates, which still exposes the environment to arbitrary upstream code execution. Although the stated operation is lower risk than install, the execution path is the same and could be abused through package compromise.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
94% confidence
Finding

npx skills update invokes an unpinned remote package and performs broad update actions, making it a high-risk supply-chain entry point. An attacker controlling the upstream package or a dependency could execute code and alter installed skills across the environment.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The workflow instructs running npx skills find [query] as part of routine discovery, again executing mutable remote package code. In this skill's context, broad activation conditions make accidental invocation more likely, increasing exposure to supply-chain compromise during normal conversations.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

This example search command for React performance uses an unpinned npx package, allowing upstream code changes to alter behavior or execute arbitrary code. Because the skill normalizes these commands as standard usage, users may execute them without understanding the trust boundary.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The PR review example similarly relies on an unpinned npx package, exposing the environment to arbitrary upstream code execution. Since this is presented as a copy-paste command, the likelihood of direct unsafe use is high.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The changelog search example repeats the same unpinned dynamic execution pattern. Even benign search functionality becomes dangerous when the executable is fetched live from the package ecosystem without version or integrity constraints.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The returned install guidance tells users to run npx skills add <owner/repo@skill> while the CLI remains unpinned and the target source may be remote. This creates a double supply-chain risk: mutable bootstrap code plus potentially unreviewed installed content.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
96% confidence
Finding

The example installation command encourages executing an unpinned package manager to install external code. In the context of a skill whose purpose is discovering and adding more skills, this substantially increases risk because the workflow is specifically designed to import third-party content.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill instructs using -g -y for installation, which performs global system-impacting changes while suppressing confirmation prompts and does not include a warning about the consequences. In combination with third-party skill installation, this materially increases the chance of silent or insufficiently reviewed modification of the user's environment.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
97% confidence
Finding

npx skills add <owner/repo@skill> -g -y is especially dangerous because it combines unpinned remote code execution with global installation and suppressed confirmation. A compromised upstream package or malicious skill could make system-wide changes with minimal friction and little opportunity for the user to notice or intervene.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
94% confidence
Finding

The recommendation to use npx skills init still executes the unpinned CLI from a remote source. While initialization is less directly dangerous than install or update, it remains an arbitrary code execution path if the upstream package is compromised.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
94% confidence
Finding

This additional unpinned npx skills reference repeats the same supply-chain risk pattern. Repetition across the skill increases the chance of unsafe copy-paste execution and indicates the risk is systemic rather than isolated.

Content

No source excerpt is available for this finding.