clrun - Interactive CLI for agent with a LLM readable YAML response surface

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:05 PM UTC
• Version: 1.0.0

Overview

The skill is a coherent terminal-session helper, but it deserves review because it tells agents to run mutable npm packages and includes an unsafe example that prints an API-key-shaped value.

Install only a pinned, reviewed clrun version, avoid running @latest scaffolders in trusted workspaces, and use an isolated environment without production secrets. Do not echo real API keys or tokens in clrun sessions, and clean up long-running sessions when finished.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:7

Finding

Execution of Unpinned Third-Party npm Packages

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:7; references/tui-patterns.md:8, references/tui-patterns.md:26, and references/tui-patterns.md:42
Vulnerability Type: Unpinned and mutable third-party dependencies
Risk Level: Medium

The Skill recommends installing or executing npm packages without pinning them to reviewed versions.

Relevant code snippets:

SKILL.md:7

yaml

compatibility: Requires Node.js >= 18 and clrun installed (npm install -g clrun or npx clrun).

references/tui-patterns.md:6-8

bash

# 1. Start the scaffolder
clrun "npx create-vue@latest"

references/tui-patterns.md:24-26

bash

# 6. Install dependencies and start dev server
clrun <id> "cd my-vue-app && npm install"

references/tui-patterns.md:40-42

bash

# 1. Start scaffolder
clrun "npx create-vite@latest"

Technical Analysis

Bare npx clrun, npm install -g clrun, and package specifiers using @latest resolve package contents at execution time rather than using an immutable, previously reviewed version. The effective code can therefore change after the Skill itself has been audited.

npm packages may execute JavaScript through their CLI entry points and lifecycle scripts. The subsequent npm install also installs dependencies from a newly generated manifest and may run their lifecycle scripts. If the relevant package, maintainer account, transitive dependency, or package-distribution channel is compromised, following these instructions can execute attacker-controlled code.

No evidence establishes that the named packages are currently malicious. The vulnerability is the Skill's reliance on mutable, unverified supply-chain inputs.

Attack Path

1. An attacker compromises a referenced npm package, its maintainer account, or a transitive dependency and publishes a malicious release.
2. Because the instructions use a bare package name or `@lates ...[truncated 1078 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin every directly executed npm package to an exact reviewed version instead of using bare names or @latest.
2. Replace examples such as npx create-vue@latest with an exact version, for example npx create-vue@X.Y.Z, after reviewing that release.
3. Avoid global package installation where possible. Use a project-local, exact-version dependency with a committed lockfile.
4. Commit and enforce lockfiles, and use npm ci rather than unconstrained npm install for reproducible installation.
5. Verify package provenance and integrity using registry integrity metadata, trusted publication information, and organizational package allowlists.
6. Review direct and transitive dependencies before updating pinned versions.
7. Disable lifecycle scripts with --ignore-scripts when they are unnecessary. If scripts are required, inspect them before execution.
8. Run scaffolders and dependency installation in an isolated, least-privileged environment without production credentials or access to sensitive host directories.
9. Document the exact approved package names and versions to reduce dependency-confusion and typosquatting exposure.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The skill instructs users to install or invoke clrun via npx clrun without pinning an exact version, which allows whatever version is currently published or resolved at execution time to run. In an agent-executed CLI skill, that is especially dangerous because the fetched package can change over time or be replaced in a supply-chain compromise, leading to arbitrary code execution in the agent's environment.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The documentation demonstrates setting an API key and then echoing it back to terminal output, which normalizes unsafe handling of secrets. In a tool specifically designed to persist and inspect interactive terminal sessions, that increases the chance secrets will be exposed in logs, transcripts, screenshots, scrollback, or downstream agent output.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The example explicitly reveals a secret-shaped token (sk-12345) through echo $API_KEY, creating direct secret disclosure in terminal output. Because clrun supports tailing persistent sessions, exposed values may remain accessible after the fact and could be unintentionally propagated to users, logs, or other tooling.

Content

No source excerpt is available for this finding.

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 60% confidence

Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · references/tui-patterns.md (reported line 139)May include surrounding context.

md

# Set variables
clrun <id> "export API_KEY=sk-12345"
clrun <id> "export NODE_ENV=development"

# Use them later in the same session
clrun <id> 'echo $API_KEY'