ClawHub
Back to skill

Security audit

Preflyt

Security checks for vulnerabilities and agentic risk

Overview

The skill has a legitimate scanning purpose, but it should be reviewed because it tells agents and CI to automatically run an unpinned npm package after deployments.

Before installing, prefer a pinned and reviewed preflyt-check version installed through your project lockfile, run it in a least-privileged CI job, confirm the target URL belongs to your deployment before scanning, avoid passing license keys on the command line, and use --share only when a public report is acceptable.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Error
Location
SKILL.md:28
Finding

Unpinned npm Package Is Automatically Downloaded and Executed

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:28-42, SKILL.md:103-110, README.md:11-15
Vulnerability Type: Unpinned third-party package execution
Risk Level: High

The Skill repeatedly instructs agents and CI systems to execute preflyt-check through npx without specifying an audited package version or using an integrity-protected lockfile.

Relevant command examples from SKILL.md:28-42:

bash
npx preflyt-check https://your-deployed-url.com
bash
# Fail if issues found (for CI/CD)
npx preflyt-check https://your-deployed-url.com --fail

# Generate a shareable report link
npx preflyt-check https://your-deployed-url.com --share

# With Pro license for unlimited scans
npx preflyt-check https://your-deployed-url.com --key YOUR_LICENSE_KEY

The automatic execution behavior is defined in SKILL.md:103-110:

markdown
## Agent behavior

When a deployment to a public URL is detected:
1. Run `npx preflyt-check <deployed-url>`
2. If HIGH severity findings exist, recommend immediate fix
3. If MEDIUM or LOW findings, inform the user and suggest fixes
4. If no findings, confirm deployment appears safe
5. Never let a Preflyt error block a deployment - if the scan fails, report the error and move on

The same unpinned invocation is presented as the standard usage in README.md:11-15:

markdown
Your agent runs this after any deploy:
```bash
npx preflyt-check https://your-site.com
text

### Technical Analysis

An `npx` invocation without an exact package version can resolve and download the package version currently exposed by the npm registry. The reviewed project contains no local implementation, committed dependency lockfile, integrity hash, or package provenance verification that constrains which code will execute.

Consequently, the executable payload can change after this Skill has been reviewed. If the npm publisher account, package, registry 
...[truncated 2318 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin preflyt-check to an exact, reviewed version rather than resolving the registry's current version:

    bash
    npx --yes preflyt-check@<audited-exact-version> https://your-deployed-url.com

  2. Prefer declaring the scanner in devDependencies, committing the generated lockfile, and installing with lockfile enforcement:

    bash
    npm install --save-dev --save-exact preflyt-check@<audited-exact-version>
npm ci
npx --no-install preflyt-check https://your-deployed-url.com

  3. Commit package-lock.json and use npm ci so unexpected dependency changes cause installation failure rather than silent resolution to newer packages.

  4. Verify npm package provenance, publisher ownership, release signatures where available, and integrity metadata before approving version updates.

  5. Execute the scanner in a sandboxed, least-privileged job with no write access to deployment artifacts and no unrelated CI secrets. Restrict outbound network access to destinations required for the documented scan.

  6. Avoid passing license keys directly on the command line where they may be exposed through process listings or logs. If the package supports a protected environment variable or secret-file mechanism, use that mechanism and expose the secret only to the isolated scan step.

  7. Require explicit user approval before downloading or executing a package version that is not already installed and verified locally.

  8. Update every invocation in SKILL.md and README.md, including deployment scripts, Git hooks, and GitHub Actions examples, so users are not directed back to the unpinned command.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (15)

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 5)May include surrounding context.

md
name: preflyt
description: >-
  Scan deployed web apps for security misconfigurations after every deploy.
  Checks for exposed .env files, databases, source code, open ports, missing
  security headers, .git exposure, directory listings, and more. Non-intrusive, read-only.
metadata:
  openclaw:

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 50)May include surrounding context.

md
name: preflyt
description: >-
  Scan deployed web apps for security misconfigurations after every deploy.
  Checks for exposed .env files, databases, source code, open ports, missing
  security headers, .git exposure, directory listings, and more. Non-intrusive, read-only.
metadata:
  openclaw:

Rp1

Medium
Category
MCP Rug Pull
Confidence
93% confidence
Finding

Using npx preflyt-check without a pinned version causes the latest package version to be fetched and executed at runtime, which introduces a supply-chain execution risk. If the package is compromised, typosquatted, or updated with unsafe behavior, an agent may automatically run attacker-controlled code during deployment workflows.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The statement that adding SKILL.md lets the agent 'pick it up automatically' is broad and does not clearly constrain when network scanning is allowed, what targets are in scope, or whether explicit user approval is required. In an agentic environment, vague auto-invocation guidance can cause unintended external scanning, policy violations, or scanning of attacker-influenced URLs after every deploy.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
93% confidence
Finding

Recommending npx preflyt-check without a pinned version in CI or blocking workflows is especially risky because the command may be executed automatically in privileged environments. A malicious or compromised upstream package release could gain code execution in build pipelines and access secrets, tokens, or deployment credentials.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
94% confidence
Finding

Using npx preflyt-check without pinning an exact package version causes the agent to fetch and execute whatever version is current at runtime. In an automated deployment context, that creates a supply-chain risk: a compromised maintainer account, malicious new release, or unexpected breaking update could result in arbitrary code execution on the host running the skill.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
94% confidence
Finding

This command example invokes an unpinned npm package through npx, which can download and execute the latest published code at runtime. Because the skill is intended for post-deploy automation, this exposes deployment environments to remote code execution via package compromise or malicious updates.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill recommends generating a shareable public report link without a prominent warning that scan results may reveal sensitive security posture details, exposed paths, or misconfiguration evidence. Even if intended for convenience, public sharing can aid attackers by advertising weaknesses and target metadata.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
94% confidence
Finding

The --share example still uses unpinned npx execution, so it inherits the same supply-chain execution risk as the other command examples. Since users may copy-paste this directly into automation, any malicious or compromised package release could execute in privileged deployment contexts.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
94% confidence
Finding

The license-key example executes an unpinned package and additionally encourages providing a sensitive token on the command line. The primary issue here is the unpinned remote package execution, which could expose the environment and any passed secrets if a malicious version is installed.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
93% confidence
Finding

Embedding npx preflyt-check in a deploy script means every deployment may execute newly published package code without review. That materially increases the blast radius of an npm supply-chain compromise because the script likely runs with access to production credentials, source, and infrastructure.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
93% confidence
Finding

The post-receive hook example automatically runs an unpinned npx package after code updates. Hooks often run unattended and may have broad access, making this a strong supply-chain risk if the npm package is replaced or a malicious version is published.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
93% confidence
Finding

The GitHub Actions example runs unpinned package code in CI, where secrets, tokens, and deployment metadata are commonly available. A malicious package update could exfiltrate CI secrets or tamper with the pipeline.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The activation rule 'When a deployment to a public URL is detected' is broad and underspecified, which can trigger the skill in unintended contexts and cause autonomous outbound requests to URLs without clear user confirmation. In an agent setting, vague activation increases the chance of scanning the wrong target, surprising users, or interacting with sensitive staging or third-party endpoints.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
92% confidence
Finding

The agent behavior section instructs automated execution of npx preflyt-check <deployed-url> without version pinning. Because this drives autonomous behavior, the risk is elevated: the agent may repeatedly execute unreviewed remote package code whenever it detects a deployment.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.