ClawHub
Back to skill

Security audit

Learn-X

Security checks for vulnerabilities and agentic risk

Overview

This is a conversational learning-coach skill with no hidden code or data access, though its install commands and broad activation wording deserve user attention.

Install from a reviewed commit or pinned package version when possible, prefer project-scoped installation over global installation, and expect the coaching flow to be structured and Socratic rather than direct explanation. Non-Chinese users should confirm their agent will respond in their preferred language.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T08 · Insecure Dependencies

Warning
Location
README-en.md:173
Finding

Unpinned Third-Party Package Execution in English Installation Instructions

Content
View full analysis

Vulnerability Details

File Location: README-en.md:173-180
Vulnerability Type: Unpinned package retrieval and execution
Risk Level: Medium

Vulnerable Code:

bash
Via [skills.sh](https://skills.sh) (works for Claude Code, Cursor, Codex, CodeBuddy, OpenCode, and [50+ other agents](https://github.com/vercel-labs/skills#supported-agents)):

# Global install — available across all projects
npx skills add dimayip/learn-x -g -a claude-code

# Project-scoped install — committed with your repo
npx skills add dimayip/learn-x -a codebuddy

Technical Analysis

The installation instructions invoke npx skills without pinning an exact package version or verifying package integrity. If the package is not already available locally, npx can retrieve the current version of the skills package from the configured package registry and execute its code.

Consequently, the code executed by this command is mutable and is not limited to the static repository content covered by this audit. A future compromised, replaced, or unexpectedly modified package release could run arbitrary installation logic. The global installation option additionally permits the installer to modify Skill directories shared across projects.

This is a supply-chain weakness rather than evidence that the current package is malicious.

Attack Path

  1. An attacker compromises the registry package, its maintainer account, or its publication pipeline.
  2. The attacker publishes a malicious version under the package name resolved by npx skills.
  3. A user follows the documented installation command without specifying a reviewed version.
  4. npx downloads and executes the attacker-controlled package code.
  5. The malicious installer operates with the invoking user's privileges and can modify files accessible to that user, including Agent configuration or shared Skill directories.

Impact Assessment

Successful exploitation could p ...[truncated 498 chars]

Remediation
View remediation

Remediation Suggestions

  • Pin the installer to an exact, reviewed package version rather than resolving the latest release implicitly.
  • Use a lockfile-backed installation workflow where supported.
  • Publish and verify package integrity information, such as a registry integrity digest or documented checksum.
  • State the exact registry and package identity that the command is expected to resolve.
  • Prefer project-scoped installation by default and document the additional scope of global installation.
  • Recommend reviewing the package provenance, release signature, and lifecycle scripts before execution.
  • Consider presenting the non-executing repository clone method as the primary installation path, ideally pinned to a reviewed commit or release tag.

T08 · Insecure Dependencies

Warning
Location
README.md:173
Finding

Unpinned Third-Party Package Execution in Chinese Installation Instructions

Content
View full analysis

Vulnerability Details

File Location: README.md:173-180
Vulnerability Type: Unpinned package retrieval and execution
Risk Level: Medium

Vulnerable Code:

bash
通过 [skills.sh](https://skills.sh) 安装（支持 Claude Code / Cursor / Codex / CodeBuddy / OpenCode 等 [50+ 种 agent](https://github.com/vercel-labs/skills#supported-agents)）：

# 全局安装 — 所有项目共享
npx skills add dimayip/learn-x -g -a claude-code

# 项目级安装 — 随仓库提交
npx skills add dimayip/learn-x -a codebuddy

Technical Analysis

The localized installation instructions reproduce the same unpinned npx skills invocation. The command can download and execute whichever package version the configured registry resolves at installation time. No exact version, integrity digest, signature check, or lockfile constrains the retrieved code.

The effective installation payload can therefore change after this Skill has been reviewed. Compromise of the external package or its publication channel could convert the documented command into an arbitrary code-execution path. The global installation option may also modify Agent resources used by unrelated projects.

No malicious package behavior was observed in the audited repository; the finding concerns unsafe dependency retrieval and execution.

Attack Path

  1. An attacker gains control of the package release process, registry entry, or maintainer credentials associated with the package resolved as skills.
  2. A modified package version containing malicious installation behavior is published.
  3. A user copies the unpinned command from README.md.
  4. npx retrieves and executes the compromised version.
  5. The package accesses or changes resources available to the invoking user, potentially including project files and shared Agent Skill configuration.

Impact Assessment

Exploitation could result in arbitrary code execution under the installing user's account. Potential exposure includes accessible repos ...[truncated 329 chars]

Remediation
View remediation

Remediation Suggestions

  • Replace the unversioned invocation with an exact, reviewed package version.
  • Use dependency locking and registry integrity verification where available.
  • Document the expected package publisher, registry, version, and integrity value.
  • Make project-scoped installation the recommended default.
  • Clearly warn that npx retrieves and executes external package code with the user's privileges.
  • Pin manual repository installations to a reviewed release tag or commit.
  • Keep all localized installation instructions synchronized so security hardening is applied consistently.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (13)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The trigger phrases are intentionally broad and include common learning-oriented language such as 'help me learn / understand / get good at', which can match ordinary conversation and cause the skill to activate unexpectedly. In an agent setting, over-broad activation can override more appropriate skills or system behavior, leading to misrouting, unwanted prompting patterns, and reduced user control over how requests are handled.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The trigger conditions are intentionally broad enough to match many ordinary requests about learning or understanding topics, which raises the chance that this skill activates in contexts where a narrower or more appropriate skill should be used. Overbroad activation can override expected agent behavior, steer conversations into a rigid workflow, and create prompt-routing interference across unrelated tasks.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The trigger description is extremely broad and domain-agnostic, covering nearly any request to learn or understand something. This can cause unintended invocation in sensitive contexts, where the skill's rigid conversational constraints may override safer or more appropriate default handling, including for domains that need specialized safety behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The skill content is written entirely in Chinese and does not instruct the agent to preserve or ask for the user's preferred language. This can degrade comprehension, consent, and usability, especially if the skill activates for non-Chinese user requests, increasing the chance of misunderstanding in learning flows.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The playbook is written entirely in Chinese and prescribes exact Chinese phrasing for the interaction flow, without offering a language-selection step or documenting that the skill is intentionally restricted to Chinese-speaking users. In a general-purpose learning skill, this can cause exclusion, misunderstanding, and unsafe or low-quality user guidance if the agent applies the script to users who do not understand Chinese.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

This markdown file presents all instructions and examples solely in Chinese, which can amount to a language/locale policy violation when no user opt-in or alternative language option is provided. The policy explicitly calls for flagging skills that force a specific language without user choice unless the constraint is justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
76% confidence
Finding

The file highlights the English version as the current active document while also linking to a Chinese version, but the usage guidance does not explicitly state that the learner's preferred language should be chosen at runtime. Since the skill is intended for broad, subject-agnostic use, an explicit language-choice instruction would better avoid a default-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
83% confidence
Finding

The file is written in Simplified Chinese and presents an English link as an alternate version, which effectively makes Chinese the default experience in this document. There is no explicit statement that language should follow user preference or that users may choose their preferred locale, which can conflict with language-choice policy expectations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

This markdown file presents all instructions, templates, and rules exclusively in Chinese, and it does not indicate that the user can choose another language or that the skill is intentionally limited to a Chinese-speaking context. That creates a natural-language policy concern under the language/locale rule because it effectively forces a specific language without user opt-in.

Content

No source excerpt is available for this finding.