ClawHub
Back to skill

Security audit

gui.new

Security checks for vulnerabilities and agentic risk

Overview

This skill openly sends user-provided HTML or Mermaid content to gui.new to create public shareable links, which matches its stated purpose.

Install only if you are comfortable sending generated HTML or Mermaid diagrams to gui.new and sharing the resulting public URL. Do not use it for secrets, private customer data, confidential business content, or anything that should not be visible to someone with the link; prefer direct API calls or pinned SDK versions in isolated environments if using the optional SDKs.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:80
Finding
Unpinned Third-Party SDK Installation## Vulnerability Details **File Location**: `SKILL.md`, lines 80–83 **Vulnerability Type**: Insecure third-party dependency installation **Risk Level**: Medium ### Vulnerable Code ```markdown ## SDKs - npm: `npm install gui-new` - pip: `pip install gui-new` ``` ### Technical Analysis The documented npm and pip commands install the latest dependency versions resolved from external package registries. The instructions do not specify exact audited versions, lockfiles, cryptographic hashes, signatures, or verified source repositories. Because package registry contents and version-resolution results can change after the Skill has been reviewed, following these commands may install code that was not included in this audit. npm packages can run package-controlled lifecycle scripts during installation. Python packages may execute package-controlled build logic, while installed SDK code may execute when subsequently imported. This creates a supply-chain exposure if the package publisher account or registry is compromised, the package is taken over, or a future release becomes malicious. The audit did not establish that the named packages are currently malicious; the finding concerns the unsafe, mutable installation method. ### Attack Path 1. An attacker compromises the package publisher, registry account, release pipeline, or another component of the package distribution chain. 2. The attacker publishes a malicious version under the referenced package name. 3. A user follows `npm install gui-new` or `pip install gui-new`. 4. The package manager resolves and downloads the attacker-controlled release because no audited version or integrity value is required. 5. Malicious code executes through an npm installation lifecycle script, Python build/install behavior, or later SDK import and use. 6. The payload operates with the permissions of the account running the package manager or application. ### Impact Assessment Succes ...[truncated 509 chars]
Remediation
## Remediation Suggestions - Pin each SDK to a specific version that has been independently reviewed. - Provide and enforce lockfiles for reproducible dependency resolution. - For Python installations, use a requirements file containing cryptographic hashes and install with hash verification, such as `pip install --require-hashes`. - For npm, use a committed lockfile and `npm ci`; review package integrity metadata and disable lifecycle scripts where they are unnecessary. - Identify the verified package publisher and canonical source repository so users can validate package provenance. - Use trusted registries and apply dependency scanning, provenance verification, and update review in CI. - Run package installation with least privilege in an isolated environment. - Remove the SDK installation guidance if the documented direct HTTPS API calls are sufficient.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

External Transmission

Medium
Category
Data Exfiltration
Content
## Create a Canvas

```bash
curl -X POST https://gui.new/api/canvas \
  -H "Content-Type: application/json" \
  -d '{"html": "<h1>Hello</h1>", "title": "My Canvas"}'
```
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Static analysis

No suspicious patterns detected.