ClawHub
Back to skill

Security audit

token-aware-image

Security checks for vulnerabilities and agentic risk

Overview

This image-generation skill is mostly purpose-aligned, but it automatically installs and runs unpinned npm/browser tooling and launches a local editor, so it should be reviewed before installation.

Install only if you are comfortable with the skill creating a `.token-image/` workspace, installing npm dependencies from the registry, installing Playwright Chromium, generating files under `.token-image/src/`, and launching a local editor. For safer use, run it in a project sandbox with minimal secrets in the environment and prefer pinned dependencies or a reviewed lockfile before running the install steps.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
scripts/init.sh:98
Finding

Unpinned Third-Party Packages Are Installed and Executed

Content
View full analysis

Vulnerability Details

File Location: scripts/init.sh:98-115, 142-145; SKILL.md:49-53
Vulnerability Type: Unpinned npm dependency installation and execution
Risk Level: Medium

Vulnerable Code

scripts/init.sh:98-115:

bash
if [ ! -f "$WORKSPACE/package.json" ]; then
  cat > "$WORKSPACE/package.json" <<'PKGJSON'
{
  "name": "token-image-workspace",
  "private": true,
  "type": "module",
  "scripts": {
    "render": "token-image render",
    "render:2x": "token-image render --scale 2",
    "editor": "token-image editor"
  },
  "dependencies": {
    "@zane-chen/token-image": "^0.1.0",
    "react": "^18.3.0"
  },
  "devDependencies": {
    "tsx": "^4.0.0",
    "typescript": "^5.0.0",
    "@types/node": "^20.0.0",
    "@types/react": "^18.0.0"
  }
}

scripts/init.sh:142-145:

bash
# 6. Install dependencies
echo "  Installing dependencies..."
(cd "$WORKSPACE" && npm install --quiet)
echo "  ✓ Dependencies installed"

SKILL.md:49-53:

bash
Ensure Playwright browsers are installed:

```bash
npx playwright install chromium
text

### Technical Analysis

The generated workspace uses caret-based semantic version ranges rather than exact package versions and does not include a reviewed lockfile. Running `npm install` therefore allows npm to resolve newer compatible package releases after the Skill has been audited.

npm installation may execute package lifecycle scripts with the permissions of the user running the Skill. The installed `@zane-chen/token-image` package is subsequently invoked by the `render` and `editor` scripts, giving resolved package code an additional execution path.

The pre-flight command also invokes `npx playwright` without an explicit version. If Playwright is not already available locally, `npx` may retrieve and execute a registry package whose contents were not included in this audit. These b
...[truncated 1908 chars]
Remediation
View remediation

Remediation Suggestions

  1. Replace all caret ranges with reviewed exact versions, for example "@zane-chen/token-image": "0.1.0".
  2. Generate, review, and distribute a package-lock.json containing resolved versions and integrity hashes.
  3. Use npm ci with the committed lockfile instead of npm install to enforce deterministic resolution.
  4. Add Playwright as an exact, locally installed dependency and invoke its local binary. Avoid an unversioned npx playwright command.
  5. If npx remains necessary, specify an exact reviewed version and disable interactive package substitution, such as npx --no-install playwright ... after local installation.
  6. Evaluate whether dependency lifecycle scripts are required. Where compatible, install with --ignore-scripts and explicitly run only reviewed setup operations.
  7. Configure an approved npm registry and use provenance, integrity, and package-signing controls where available.
  8. Run installation and rendering in a sandbox with minimal filesystem access, no sensitive environment variables, and restricted outbound network access.
  9. Avoid --quiet in security-sensitive installation workflows so warnings and lifecycle activity remain visible in logs.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (11)

Rp1

Medium
Category
MCP Rug Pull
Confidence
89% confidence
Finding

The skill instructs use of npx playwright install chromium without pinning a specific package version. That allows the executed package version to drift over time or be influenced by registry/package resolution issues, reducing reproducibility and increasing supply-chain risk if a compromised or unexpected version is fetched.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill goes beyond generating TSX and PNG assets by automatically launching an interactive editor in the user's browser. This expands the behavior surface from offline file generation to active UI/process execution, which can surprise users and create unintended side effects in the local environment.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

Automatically opening the editor is not necessary to fulfill the stated core function of generating image assets, so it introduces extra execution behavior without a clear functional requirement. Unnecessary post-processing actions increase exposure and make it easier for a skill to perform operations the user did not specifically request.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill instructs the agent to launch a browser/editor automatically, but the skill description does not clearly warn that it will open an interactive application. That mismatch undermines informed consent and can lead to unexpected local actions, especially in automation or headless contexts.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The file uses absolute language requiring uppercase for all display text and enforces this again in the CSS with text-transform: uppercase. This can conflict with language and locale needs because forced casing is a natural-language presentation constraint without any documented opt-in or justification.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The prompt explicitly instructs the agent to write a generated TSX file directly to disk, creating a side effect without any built-in confirmation, disclosure, or constraint in the prompt itself. In an agent setting, this can enable unintended file creation or overwrite if downstream inputs such as format/index/path handling are influenced unexpectedly, and it reduces user visibility into filesystem-modifying behavior.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The manifest frames this skill as generating themed image React components and producing TSX/PNG assets. This init script not only bootstraps local files but also performs npm install, which reaches out to package registries and executes dependency installation as a side effect; that networked package-management capability is not stated in the skill description.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
83% confidence
Finding

The instruction "Nunito Black (900) for headings only — never use Nunito for body text" imposes a fixed presentation choice in natural language. Under the policy rule for language/locale-style constraints, this is a prescriptive requirement without any user choice or opt-in mechanism.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
86% confidence
Finding

The guide prescriptively requires specific font families and states they must not be mixed, which functions as a fixed language/locale presentation constraint in natural-language guidance. There is no indication that users can opt into alternatives or that the constraint is justified by a region-specific or compliance need.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
80% confidence
Finding

The guide uses absolute language such as 'for everything' and 'the ONLY color scheme,' which imposes a fixed presentation style with no user choice or contextual justification. Under the policy criteria, forced style or locale-like constraints in natural language can be a violation when no opt-in or rationale is provided.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
92% confidence
Finding

This markdown file instructs the agent to write viewport.tsx and styles.css directly to disk, which is a file-modifying operation. The document does not include any warning, confirmation step, or disclosure that existing files may be created or overwritten.

Content

No source excerpt is available for this finding.