Deprecated Skill

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 2:05 AM UTC
• Version: 0.2.0

Overview

This deprecated skill is only a migration notice, with no executable code, but users should prefer the ClawHub install path over the unpinned npx alternative.

Install the renamed skill through ClawHub where possible. Avoid the optional npx command unless you trust the current skills npm package and the referenced GitHub repository, because that command is unpinned and global.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:24

Finding

Unpinned Third-Party Dependency Execution During Migration

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 24–26
Vulnerability Type: Unpinned external package and repository installation
Risk Level: Medium

bash

npx skills add deusyu/translate-book -a claude-code -g

Technical Analysis

The documented migration command invokes the unversioned skills npm package through npx and installs Skill content from the external deusyu/translate-book GitHub repository. Neither the npm package version nor a Git commit is pinned, and the instructions provide no checksum or signature verification.

Consequently, the resources retrieved when a user runs this command may differ from those that existed when this Skill was audited. This creates a supply-chain trust boundary in which compromise, replacement, or malicious updates of the npm package or referenced repository could cause attacker-controlled installer behavior or Skill content to be executed or installed.

The -g option requests global installation, increasing the installed content's persistence and potential exposure across projects.

Attack Path

1. An attacker compromises or gains publishing control over the unpinned skills npm package, the referenced GitHub repository, or another relevant distribution component.
2. The attacker publishes a malicious package version, installer implementation, or replacement Skill content.
3. A user follows the migration instructions and runs the documented npx command.
4. npx resolves the current unpinned package, which may differ from the reviewed version.
5. The installer retrieves and globally installs attacker-controlled repository content.
6. Any malicious behavior available to the retrieved installer or subsequently loaded Skill runs with the invoking user's permissions.

Impact Assessment

Successful exploitation could execute installer behavior under the invoking user's account or install malicious Skill instructions that affect later agent sessions. The exact privileges are lim ...[truncated 298 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the npm package to a reviewed, immutable version rather than invoking an unversioned package through npx.
• Pin the source repository to a specific reviewed commit instead of a mutable branch or repository head.
• Publish and verify cryptographic checksums or signatures for the installer and Skill package.
• Use a verified first-party installation channel with provenance attestations where available.
• Remove -g unless global installation is operationally necessary; prefer project-scoped installation to reduce exposure.
• Document the expected package version, source commit, publisher identity, and integrity-verification procedure.
• Re-audit the exact pinned installer and replacement Skill before recommending migration.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence

Finding

The documentation instructs users to run npx skills add ... without pinning a specific package version. This can cause users to execute whatever package version is current at install time, increasing supply-chain risk if the package is later compromised or a breaking/malicious release is published. The deprecated-package context slightly reduces immediacy, but the command is still a live installation path presented to users.

Content

No source excerpt is available for this finding.