ClawHub
Back to skill

Security audit

competitive-ops

Security checks for vulnerabilities and agentic risk

Overview

The skill appears to be a real competitive-intelligence workflow, but its setup, report export, and monitoring features use broad local changes, unpinned third-party execution, and persistent automation that deserve review before installation.

Install only in a dedicated project or container, review setup before running it, pin npm and Python dependencies, avoid running setup with unnecessary secrets in the environment, require explicit approval for monitor mode, and sanitize company names before any filesystem or shell operation.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
.claude/skills/competitive-ops/SKILL.md:76
Finding

Unpinned Third-Party Dependencies Are Downloaded and Executed During Setup

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:76-89; .claude/skills/competitive-ops/SKILL.md:76-89; requirements.txt:1-3
Vulnerability Type: Supply-chain exposure through unpinned npm and Python dependencies
Risk Level: Medium

Vulnerable Code

From SKILL.md:76-89 and the duplicated plugin entry point .claude/skills/competitive-ops/SKILL.md:76-89:

bash
npx playwright install chromium
npx playwright --version

npx -y uipro-cli init --ai claude

claude mcp add tavily -- npx -y tavily-mcp

python3 -m venv .venv && source .venv/bin/activate && pip install -r requirements.txt

From requirements.txt:1-3:

text
pyyaml>=6.0
python-dotenv>=1.0.0
playwright>=1.40.0

Technical Analysis

The setup workflow instructs the agent to resolve and execute npm packages without exact version constraints. In particular, npx -y uipro-cli and npx -y tavily-mcp may download the currently published package version and immediately execute its CLI or lifecycle code. The -y option suppresses interactive confirmation.

The Python dependencies use lower-bound constraints rather than exact versions and are installed without a lockfile or package hashes. Consequently, the code installed during a future setup can differ materially from the code that was originally reviewed.

This behavior is functionally related to setup, but it does not follow least-change supply-chain practices. The effective setup payload remains mutable after audit because package registry state determines which code is installed.

Attack Path

  1. An attacker compromises a referenced package, its maintainer account, or the relevant package-registry distribution channel.
  2. The attacker publishes a malicious or compromised version that still satisfies the unconstrained npm resolution or Python lower-bound requirement.
  3. A user or agent invokes the Skill's setup mode.
  4. npx -y downloa ...[truncated 1136 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin every npm executable to an explicitly reviewed version, for example:
    bash
    npx --yes uipro-cli@X.Y.Z init --ai claude
npx --yes tavily-mcp@X.Y.Z
  2. Prefer installing npm dependencies from a committed lockfile and invoking their local binaries rather than dynamically running registry-selected packages.
  3. Commit and enforce package-lock.json or an equivalent lockfile with integrity metadata.
  4. Replace Python lower bounds with reviewed exact versions:
    text
    pyyaml==X.Y.Z
python-dotenv==X.Y.Z
playwright==X.Y.Z
  5. Generate and enforce cryptographic hashes, such as with pip-compile --generate-hashes, then install using:
    bash
    pip install --require-hashes -r requirements.txt
  6. Request explicit user approval before downloading or executing third-party setup components; do not silently suppress confirmation.
  7. Validate package publisher, provenance, signatures, and expected checksums before installation.
  8. Run setup in an isolated virtual environment or container with restricted filesystem access, minimal credentials, and constrained network permissions.
  9. Add automated dependency scanning and controlled update review so pinned versions receive timely security patches without silently changing the audited payload.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Findings (91)

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
85% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · .claude/skills/competitive-ops/SKILL.md (reported line 188)May include surrounding context.

md
- **Always creates new file (never overwrites)**
   - **Update symlink** to point to the new report:
     ```bash
     rm -f data/reports/latest/{company}.md
     ln -s ../{date}/{company}-{date}.md data/reports/latest/{company}.md
     ```
     This ensures `latest/` always reflects the most recent analysis, regardless of date.

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
85% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · .claude/skills/competitive-ops/modes/batch.md (reported line 50)May include surrounding context.

  1. Create markdown report: data/reports/{date}/{{company}}-{date}.md
  2. Update symlink to latest report (always rm first, then ln -s):
    bash
    rm -f data/reports/latest/{{company}}.md
ln -s ../{date}/{{company}}-{date}.md data/reports/latest/{{company}}.md
    This ensures latest/ always points to the most recent analysis regardless of date.

Chaining Abuse

High
Category
Tool Misuse
Confidence
75% confidence
Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · .claude/skills/ui-ux-pro-max/SKILL.md (reported line 111)May include surrounding context.

Ubuntu/Debian:

bash
sudo apt update && sudo apt install python3

Windows:

Unvalidated Output Injection

High
Category
Output Handling
Confidence
65% confidence
Finding

Model output is used without validation or sanitization. Unvalidated output injected into downstream contexts (SQL, shell, HTML) enables injection attacks and arbitrary code execution.

Content

Scanner excerpt · .claude/skills/ui-ux-pro-max/data/react-performance.csv (reported line 29)May include surrounding context.

text
25,Rendering,SVG Animation Wrapper,svg animation wrapper div,React/Next.js,Wrap SVG in div and animate wrapper for hardware acceleration,Animate div wrapper around SVG,Animate SVG element directly,"<div class='animate-spin'><svg>...</svg></div>","<svg class='animate-spin'>...</svg>",Low
26,Rendering,Content Visibility,content-visibility auto,React/Next.js,Apply content-visibility: auto to defer off-screen rendering,Use content-visibility for long lists,Render all list items immediately,".item { content-visibility: auto; contain-intrinsic-size: 0 80px }","Render 1000 items without optimization",High
27,Rendering,Hoist Static JSX,hoist static jsx element,React/Next.js,Extract static JSX outside components to avoid re-creation,Hoist static elements to module scope,Create static elements inside components,"const skeleton = <div class='animate-pulse' />; function C() { return skeleton }","function C() { return <div class='animate-pulse' /> }",Low
28,Rendering,Hydration No Flicker,hydration mismatch flicker,React/Next.js,Use inline script to set client-only data before hydration,Inject sync script for client-only values,Use useEffect causing flash,"<script dangerouslySetInnerHTML={{ __html: 'el.className = localStorage.theme' }} />","useEffect(() => setTheme(localStorage.theme), []) // flickers",Medium
29,Rendering,Conditional Render,conditional render ternary,React/Next.js,Use ternary instead of && when condition can be 0 or NaN,Use explicit ternary for conditionals,Use && with potentially falsy numbers,"{count > 0 ? <Badge>{count}</Badge> : null}","{count && <Badge>{count}</Badge>} // renders '0'",Low
30,Rendering,Activity Component,activity show hide preserve,React/Next.js,Use Activity component to preserve state/DOM for toggled components,Use Activity for expensive toggle components,Unmount/remount on visibility toggle,"<Activity mode={isOpen ? 'visible' : 'hidden'}><Menu /></Activity>","{isOpen && <Menu />} // loses state",Medium
31,JS Perf,Batch DOM CSS,batch dom cs
...[truncated 25 chars]

Unvalidated Output Injection

High
Category
Output Handling
Confidence
65% confidence
Finding

Model output is used without validation or sanitization. Unvalidated output injected into downstream contexts (SQL, shell, HTML) enables injection attacks and arbitrary code execution.

Content

Scanner excerpt · .claude/skills/ui-ux-pro-max/data/stacks/nextjs.csv (reported line 51)May include surrounding context.

text
25,Rendering,SVG Animation Wrapper,svg animation wrapper div,React/Next.js,Wrap SVG in div and animate wrapper for hardware acceleration,Animate div wrapper around SVG,Animate SVG element directly,"<div class='animate-spin'><svg>...</svg></div>","<svg class='animate-spin'>...</svg>",Low
26,Rendering,Content Visibility,content-visibility auto,React/Next.js,Apply content-visibility: auto to defer off-screen rendering,Use content-visibility for long lists,Render all list items immediately,".item { content-visibility: auto; contain-intrinsic-size: 0 80px }","Render 1000 items without optimization",High
27,Rendering,Hoist Static JSX,hoist static jsx element,React/Next.js,Extract static JSX outside components to avoid re-creation,Hoist static elements to module scope,Create static elements inside components,"const skeleton = <div class='animate-pulse' />; function C() { return skeleton }","function C() { return <div class='animate-pulse' /> }",Low
28,Rendering,Hydration No Flicker,hydration mismatch flicker,React/Next.js,Use inline script to set client-only data before hydration,Inject sync script for client-only values,Use useEffect causing flash,"<script dangerouslySetInnerHTML={{ __html: 'el.className = localStorage.theme' }} />","useEffect(() => setTheme(localStorage.theme), []) // flickers",Medium
29,Rendering,Conditional Render,conditional render ternary,React/Next.js,Use ternary instead of && when condition can be 0 or NaN,Use explicit ternary for conditionals,Use && with potentially falsy numbers,"{count > 0 ? <Badge>{count}</Badge> : null}","{count && <Badge>{count}</Badge>} // renders '0'",Low
30,Rendering,Activity Component,activity show hide preserve,React/Next.js,Use Activity component to preserve state/DOM for toggled components,Use Activity for expensive toggle components,Unmount/remount on visibility toggle,"<Activity mode={isOpen ? 'visible' : 'hidden'}><Menu /></Activity>","{isOpen && <Menu />} // loses state",Medium
31,JS Perf,Batch DOM CSS,batch dom cs
...[truncated 25 chars]

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · .claude/skills/ui-ux-pro-max/data/stacks/nextjs.csv (reported line 38)May include surrounding context.

text
34,Middleware,Keep middleware edge-compatible,Middleware runs on Edge runtime,Edge-compatible code only,Node.js APIs in middleware,Edge-compatible auth check,fs.readFile in middleware,High,
35,Environment,Use NEXT_PUBLIC prefix,Client-accessible env vars need prefix,NEXT_PUBLIC_ for client vars,Server vars exposed to client,NEXT_PUBLIC_API_URL,API_SECRET in client code,High,https://nextjs.org/docs/app/building-your-application/configuring/environment-variables
36,Environment,Validate env vars,Check required env vars exist,Validate on startup,Undefined env at runtime,if (!process.env.DATABASE_URL) throw,process.env.DATABASE_URL (might be undefined),High,
37,Environment,Use .env.local for secrets,Local env file for development secrets,.env.local gitignored,Secrets in .env committed,.env.local with secrets,.env with DATABASE_PASSWORD,High,
38,Performance,Analyze bundle size,Use @next/bundle-analyzer,Bundle analyzer in dev,Ship large bundles blindly,ANALYZE=true npm run build,No bundle analysis,Medium,https://nextjs.org/docs/app/building-your-application/optimizing/bundle-analyzer
39,Performance,Use dynamic imports,Code split with next/dynamic,dynamic() for heavy components,Import everything statically,const Chart = dynamic(() => import('./Chart')),import Chart from './Chart',Medium,https://nextjs.org/docs/app/building-your-application/optimizing/lazy-loading
40,Performance,Avoid layout shifts,Reserve space for dynamic content,Skeleton loaders aspect ratios,Content popping in,"<Skeleton className=""h-48""/>",No placeholder for async content,High,

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · .claude/skills/ui-ux-pro-max/data/stacks/nextjs.csv (reported line 38)May include surrounding context.

text
34,Middleware,Keep middleware edge-compatible,Middleware runs on Edge runtime,Edge-compatible code only,Node.js APIs in middleware,Edge-compatible auth check,fs.readFile in middleware,High,
35,Environment,Use NEXT_PUBLIC prefix,Client-accessible env vars need prefix,NEXT_PUBLIC_ for client vars,Server vars exposed to client,NEXT_PUBLIC_API_URL,API_SECRET in client code,High,https://nextjs.org/docs/app/building-your-application/configuring/environment-variables
36,Environment,Validate env vars,Check required env vars exist,Validate on startup,Undefined env at runtime,if (!process.env.DATABASE_URL) throw,process.env.DATABASE_URL (might be undefined),High,
37,Environment,Use .env.local for secrets,Local env file for development secrets,.env.local gitignored,Secrets in .env committed,.env.local with secrets,.env with DATABASE_PASSWORD,High,
38,Performance,Analyze bundle size,Use @next/bundle-analyzer,Bundle analyzer in dev,Ship large bundles blindly,ANALYZE=true npm run build,No bundle analysis,Medium,https://nextjs.org/docs/app/building-your-application/optimizing/bundle-analyzer
39,Performance,Use dynamic imports,Code split with next/dynamic,dynamic() for heavy components,Import everything statically,const Chart = dynamic(() => import('./Chart')),import Chart from './Chart',Medium,https://nextjs.org/docs/app/building-your-application/optimizing/lazy-loading
40,Performance,Avoid layout shifts,Reserve space for dynamic content,Skeleton loaders aspect ratios,Content popping in,"<Skeleton className=""h-48""/>",No placeholder for async content,High,

Instruction Override

High
Category
Prompt Injection
Confidence
90% confidence
Finding

This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.

Content

Scanner excerpt · .claude/skills/ui-ux-pro-max/data/ux-guidelines.csv (reported line 25)May include surrounding context.

text
21,Layout,Container Width,Web,Content too wide is hard to read,Limit max-width for text content (65-75ch),Let text span full viewport width,max-w-prose or max-w-3xl,Full width paragraphs,Medium
22,Touch,Touch Target Size,Mobile,Small buttons are hard to tap accurately,Minimum 44x44px touch targets,Tiny clickable areas,min-h-[44px] min-w-[44px],w-6 h-6 buttons,High
23,Touch,Touch Spacing,Mobile,Adjacent touch targets need adequate spacing,Minimum 8px gap between touch targets,Tightly packed clickable elements,gap-2 between buttons,gap-0 or gap-1,Medium
24,Touch,Gesture Conflicts,Mobile,Custom gestures can conflict with system,Avoid horizontal swipe on main content,Override system gestures,Vertical scroll primary,Horizontal swipe carousel only,Medium
25,Touch,Tap Delay,Mobile,300ms tap delay feels laggy,Use touch-action CSS or fastclick,Default mobile tap handling,touch-action: manipulation,No touch optimization,Medium
26,Touch,Pull to Refresh,Mobile,Accidental refresh is frustrating,Disable where not needed,Enable by default everywhere,overscroll-behavior: contain,Default overscroll,Low
27,Touch,Haptic Feedback,Mobile,Tactile feedback improves interaction feel,Use for confirmations and important actions,Overuse vibration feedback,navigator.vibrate(10),Vibrate on every tap,Low

Concealed Executable Artifact

High
Category
Supply Chain
Confidence
100% confidence
Finding

An executable nested in a document or hidden/disguised artifact can evade ordinary extension-based review while still being available to the skill at runtime.

Content

No source excerpt is available for this finding.

Concealed Executable Artifact

High
Category
Supply Chain
Confidence
100% confidence
Finding

An executable nested in a document or hidden/disguised artifact can evade ordinary extension-based review while still being available to the skill at runtime.

Content

No source excerpt is available for this finding.

Direct Prompt Extraction

High
Category
System Prompt Leakage
Confidence
85% confidence
Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · .claude/skills/ui-ux-pro-max/scripts/design_system.py (reported line 71)May include surrounding context.

python
# Try exact match first
        for rule in self.reasoning_data:
            if rule.get("UI_Category", "").lower() == category_lower:
                return rule

        # Try partial match
        for rule in self.reasoning_data:

Direct Prompt Extraction

High
Category
System Prompt Leakage
Confidence
85% confidence
Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · .claude/skills/ui-ux-pro-max/scripts/design_system.py (reported line 77)May include surrounding context.

python
# Try exact match first
        for rule in self.reasoning_data:
            if rule.get("UI_Category", "").lower() == category_lower:
                return rule

        # Try partial match
        for rule in self.reasoning_data:

Direct Prompt Extraction

High
Category
System Prompt Leakage
Confidence
85% confidence
Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · .claude/skills/ui-ux-pro-max/scripts/design_system.py (reported line 84)May include surrounding context.

python
# Try exact match first
        for rule in self.reasoning_data:
            if rule.get("UI_Category", "").lower() == category_lower:
                return rule

        # Try partial match
        for rule in self.reasoning_data:

Concealed Executable Artifact

High
Category
Supply Chain
Confidence
100% confidence
Finding

An executable nested in a document or hidden/disguised artifact can evade ordinary extension-based review while still being available to the skill at runtime.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 62)May include surrounding context.

2. 配置 API Key（可选）

bash
# 添加到环境变量或 .env 文件
export TAVILY_API_KEY="tvly-xxxxx"

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README_zh.md (reported line 57)May include surrounding context.

2. 配置 API Key（可选）

bash
# 添加到环境变量或 .env 文件
export TAVILY_API_KEY="tvly-xxxxx"

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

PDF export of local HTML through browser automation adds code execution surfaces, local file handling, and artifact generation beyond the core description. While not inherently malicious, undisclosed conversion workflows can increase risk if users assume the skill only performs research and reporting logic.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

PDF export of local HTML through browser automation adds code execution surfaces, local file handling, and artifact generation beyond the core description. While not inherently malicious, undisclosed conversion workflows can increase risk if users assume the skill only performs research and reporting logic.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

PDF export of local HTML through browser automation adds code execution surfaces, local file handling, and artifact generation beyond the core description. While not inherently malicious, undisclosed conversion workflows can increase risk if users assume the skill only performs research and reporting logic.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
98% confidence
Finding

The command rm -f data/reports/latest/{company}.md is dangerous because {company} is derived from user input and no sanitization or canonicalization is described. An attacker could supply path traversal or shell metacharacters to delete unintended files, and the subsequent ln -s could create misleading or unsafe links.

Content

Scanner excerpt · SKILL.md (reported line 188)May include surrounding context.

md
- **Always creates new file (never overwrites)**
   - **Update symlink** to point to the new report:
     ```bash
     rm -f data/reports/latest/{company}.md
     ln -s ../{date}/{company}-{date}.md data/reports/latest/{company}.md
     ```
     This ensures `latest/` always reflects the most recent analysis, regardless of date.

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · cv.md (reported line 3)May include surrounding context.

md
# Product Definition Template

<!-- TODO: Replace with your product/company information -->

## Company/Product Overview

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · modes/_profile.md (reported line 3)May include surrounding context.

md
# User Profile (Customize This) -- competitive-ops

<!-- ============================================================
     THIS FILE IS YOURS. It will NEVER be auto-updated.

     Customize everything here: your target archetypes, focus areas,

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · modes/_profile.md (reported line 15)May include surrounding context.

md
## Your Focus

<!-- What market are you analyzing? What problem do you solve? -->

| Dimension | Your Focus |
|-----------|-------------|

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · modes/_profile.md (reported line 42)May include surrounding context.

md
## Archetypes

<!-- Which competitor archetypes are most relevant to your analysis? -->

| Archetype | Relevance | Why |
|-----------|-----------|-----|

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · modes/_shared.md (reported line 3)May include surrounding context.

md
# System Context -- competitive-ops

<!-- ============================================================
     THIS FILE IS AUTO-UPDATABLE. Don't put company-specific data here.

     Your customizations go in modes/_profile.md (never auto-updated).

Static analysis

No suspicious patterns detected.