ClawHub
Back to skill

Security audit

Smart Skill Finder

Security checks for vulnerabilities and agentic risk

Overview

This skill mostly matches its stated purpose, but it contains unsafe local command execution and overstates security verification for recommended third-party skills.

Install only if you are comfortable reviewing and fixing the unsafe `npx` shell invocation first. Treat its recommendations as unverified, review any suggested skill manually, and avoid pasting sensitive project names or confidential task descriptions into searches until the external data flows and CLI behavior are clearly disclosed and controlled.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/ecosystems.py:53
Finding

Arbitrary Shell Command Injection Through User-Controlled Search Queries

Content
View full analysis

Vulnerability Details

File Location: scripts/ecosystems.py:53-68
Vulnerability Type: OS command injection through unsafe shell invocation
Risk Level: High

Vulnerable Code

python
# Build search query from keywords
search_terms = " ".join(query.get('keywords', []))
if not search_terms:
    search_terms = query.get('task', '')

if not search_terms:
    return []

# Execute Skills CLI search
cmd = f'npx skills find "{search_terms}" --json'
result = subprocess.run(
    cmd, 
    shell=True, 
    capture_output=True, 
    text=True, 
    timeout=10
)

Technical Analysis

The search terms originate from the user's natural-language query and are interpolated directly into a command string. The command is then executed with shell=True, causing shell metacharacters, command substitutions, and quote characters in the query to be interpreted by the operating-system shell.

Quoting search_terms with double quotes is not sufficient. An attacker can include a closing double quote followed by a shell command. The query is split into keywords by understand_user_need() in scripts/skill_finder.py, but that operation does not sanitize shell syntax. The first five attacker-controlled tokens can therefore reach this command construction.

The subprocess timeout only limits execution duration; it does not prevent injected commands from reading files, changing files, spawning background processes, or making network requests.

Attack Path

  1. An attacker supplies a crafted skill-search query containing a closing quote and a shell command, such as tokens structured to produce " ; id ; echo ".
  2. SmartSkillFinder.understand_user_need() converts the query to keyword tokens without removing shell syntax.
  3. search_ecosystems() passes those tokens to search_skills_cli().
  4. search_skills_cli() joins the tokens and inserts them into the command string.
  5. `subprocess.run(..., ...[truncated 734 chars]
Remediation
View remediation

Remediation Suggestions

Eliminate shell interpretation and pass each argument separately:

python
result = subprocess.run(
    ["npx", "--no-install", "skills", "find", search_terms, "--json"],
    shell=False,
    capture_output=True,
    text=True,
    timeout=10,
    check=False,
)

Apply the following additional controls:

  1. Reject control characters and enforce a reasonable maximum query length.
  2. Use an allowlisted local executable path rather than relying on shell command resolution.
  3. Prefer a documented HTTPS API over invoking a package runner.
  4. Run the search integration with minimal filesystem and network privileges.
  5. Add regression tests containing quotes, semicolons, command substitutions, newlines, pipes, and redirection operators.
  6. Ensure all duplicate implementations use the corrected invocation pattern.

T08 · Insecure Dependencies

Warning
Location
scripts/ecosystems.py:60
Finding

Unpinned Third-Party Package Execution Through npx

Content
View full analysis

Vulnerability Details

File Location: scripts/ecosystems.py:60-68
Vulnerability Type: Unsafe and unpinned runtime dependency execution
Risk Level: Medium

Vulnerable Code

python
# Execute Skills CLI search
cmd = f'npx skills find "{search_terms}" --json'
result = subprocess.run(
    cmd, 
    shell=True, 
    capture_output=True, 
    text=True, 
    timeout=10
)

Technical Analysis

The skill invokes the unversioned skills npm package through npx. No dependency declaration, lockfile, exact version, integrity hash, or verified local binary is included in the project.

Depending on the installed npm version and configuration, npx can resolve and download a package that is not already installed locally. The resolved package's CLI and potentially its lifecycle behavior then execute in the Agent environment. Because no version is pinned, the effective third-party code can change after this skill has been audited.

This behavior also conflicts with the project's claims that it is read-only and does not execute installation-related commands. Although the generated recommendation commands are not automatically executed, the search implementation itself executes a package runner.

Attack Path

  1. A user invokes skill discovery.
  2. search_skills_cli() launches npx skills.
  3. If a suitable verified local package is unavailable, npx may resolve the package from the configured npm registry.
  4. A compromised package release, registry response, account, or package-resolution configuration supplies hostile code.
  5. npx executes that code with the privileges and environment of the Agent process.

This path does not require malicious query syntax; invoking the normal Skills CLI search can trigger dependency resolution.

Impact Assessment

A compromised dependency could execute arbitrary code as the Agent's operating-system user. The potential scope includes:

  • Access ...[truncated 455 chars]
Remediation
View remediation

Remediation Suggestions

  1. Add the audited dependency at an exact version and commit a lockfile containing integrity metadata.
  2. Install dependencies during a controlled deployment or build phase, not dynamically during a user query.
  3. Execute only a verified local binary and use npx --no-install if npx must be retained.
  4. Prefer a stable, authenticated HTTPS API that returns data without executing third-party package code.
  5. Verify package publisher identity, provenance, signatures, and integrity before upgrades.
  6. Run the integration in a sandbox with restricted filesystem access, a minimal environment, and narrowly scoped network access.
  7. Update the documentation to accurately disclose that the implementation invokes an external CLI.

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/ecosystems.py:85
Finding

Unverified Skills CLI Results Are Falsely Reported as Security Verified

Content
View full analysis

Vulnerability Details

File Location: scripts/ecosystems.py:85-124
Vulnerability Type: Unsupported security-verification status assigned to third-party packages
Risk Level: Medium

Vulnerable Code

python
def _parse_skills_cli_results(self, skills_data: List[Dict], query: str) -> List[SkillResult]:
    """Parse JSON output from Skills CLI."""
    results = []

    for skill_data in skills_data[:5]:
        try:
            skill = SkillResult(
                name=skill_data.get('name', 'Unknown Skill'),
                description=skill_data.get('description', 'No description available'),
                ecosystem='Skills CLI',
                source_url=skill_data.get('url', ''),
                install_command=f"npx skills add {skill_data.get('package', '')}",
                popularity_score=skill_data.get('installs', 0),
                security_status='clean'
            )
            results.append(skill)
        except (KeyError, TypeError):
            continue

    return results

def _parse_skills_cli_text_output(self, output: str, query: str) -> List[SkillResult]:
    """Parse text output from older Skills CLI versions."""
    results = []
    lines = output.split('\n')

    for line in lines[:5]:
        if 'Install with' in line and '@' in line:
            try:
                parts = line.split('npx skills add ')
                if len(parts) > 1:
                    package = parts[1].strip()
                    skill_name = package.split('@')[-1] if '@' in package else package

                    skill = SkillResult(
                        name=skill_name,
                        description=f'Skill for {query}',
                        ecosystem='Skills CLI',
                        source_url='',
                        install_command=f'npx skills add {package}',
                        popularity_score=0,
                        secu
...[truncated 2126 chars]
Remediation
View remediation

Remediation Suggestions

  1. Default all Skills CLI results to security_status='unknown'.
  2. Assign clean only when an authenticated and documented scanner reports a benign verdict for the exact immutable package version.
  3. Preserve scanner provenance, scan time, package digest, version, and individual engine results.
  4. Distinguish statuses such as unknown, not_scanned, pending, verified_clean, and suspicious.
  5. Change user-facing wording from “Security verified” to a precise statement identifying the scanner and package version.
  6. Treat malformed or missing scanner data as unknown rather than clean.
  7. Recommend source review and isolated testing before installation, even when a valid scan is available.
  8. Add tests confirming that ordinary registry search results are never labeled verified without supporting scanner evidence.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (27)

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
99% confidence
Finding

Using subprocess.run with shell=True on a command string that embeds user-controlled input is a classic command-injection flaw. Skill-finder context makes this more dangerous because the feature appears innocuous, so callers may provide arbitrary text without realizing it reaches a shell and may execute unintended commands.

Content

Scanner excerpt · scripts/ecosystems.py (reported line 61)May include surrounding context.

python
# Execute Skills CLI search
            cmd = f'npx skills find "{search_terms}" --json'
            result = subprocess.run(
                cmd, 
                shell=True, 
                capture_output=True,

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding

The skill advertises behavior that searches multiple external ecosystems and provides installation guidance, which strongly implies network access and potentially shell-oriented command generation, yet it declares no explicit tool scope or permissions. This creates a least-privilege failure: a host agent may grant broader capabilities than intended, and users are not given a clear boundary for what the skill is allowed to access or suggest.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger guidance includes very broad phrases like 'How do I do X?', 'Can you help me with X?', and other generic requests that could match ordinary conversation rather than explicit skill-discovery intent. Over-broad activation can cause unintended invocation, leading the agent to search external ecosystems or recommend third-party skills in contexts where the user did not ask for capability discovery, increasing exposure to untrusted content and confusing behavior.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
94% confidence
Finding

The install command uses npx skills add {package} without pinning the skills package to a specific version. This causes execution of whatever version is current at install time, which creates a supply-chain risk if a malicious or compromised release is published, or if behavior changes unexpectedly. In this skill-finder context, the risk is elevated because the tool recommends and presents install commands to users, making unsafe defaults more likely to be copied and executed.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
90% confidence
Finding

The example recommends invoking npx skills add ... without pinning the skills package/tool version, which can cause consumers to execute whatever version is current at install time. If the upstream package is compromised or a breaking/malicious release is published, users following the documentation could run unexpected code during installation.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

This documentation again instructs users to run npx skills add ... without pinning the skills CLI version. Because npx resolves and executes packages dynamically, the example exposes users to supply-chain risk from future package changes or compromise.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The example marks the skill as 'Security verified' while still using an unpinned npx skills invocation, which may increase user trust and make them more likely to execute a mutable package version. The dangerous part is not the skill name itself but the dynamic, unversioned tool execution path.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

This line repeats the same pattern: unversioned npx skills add ... execution in user-facing installation guidance. Repetition across examples increases exposure because readers may copy-paste the command as-is, trusting the doc's recommendations.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
90% confidence
Finding

In the API-unavailable fallback scenario, the example still relies on npx skills without pinning a version. Because fallback flows may be used during degraded conditions, users may be even less likely to verify what is being executed, increasing supply-chain exposure.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
90% confidence
Finding

This example recommends npx skills add browser-use/browser-use with no pinned skills version, again creating a mutable execution path. The surrounding 'Security verified' language may further reduce user caution, making the documentation context somewhat more dangerous than a neutral mention.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The inline documentation says browser automation will be handled by the main module and that this file only provides logic and data structures. In reality, multiple methods in this module directly call browser_controller.open(), snapshot(), type(), and press_key() to automate web navigation and searches, which contradicts the documented intent.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
89% confidence
Finding

The generated install command uses npx skills without pinning an exact package version, which can cause users to execute whatever version is current at install time. If the upstream package is compromised, typosquatted, or changes behavior unexpectedly, users may run unreviewed code during skill discovery or installation.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
88% confidence
Finding

The command uses 'npx skills' without pinning an exact package version, which creates a supply-chain risk: the resolved package may change over time or be poisoned upstream. Because this package is executed locally, a compromised dependency could run arbitrary code in the agent environment.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

For a skill whose stated purpose is only to find and recommend skills, spawning a local shell command expands capability beyond what is necessary. That broader capability materially increases blast radius, especially because the command includes user-derived input and executes an external package manager tool.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

User-provided search terms are sent into a shell-backed local command without any disclosure to the user. In this context, the lack of transparency is dangerous because the operation is not just a search; it can trigger local package execution and compound the command-injection and supply-chain risks.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
98% confidence
Finding

The code builds a shell command with user-derived search terms and executes it with shell=True. Even though the query is wrapped in double quotes, shell metacharacters such as command substitution can still be interpreted by the shell, enabling command injection and arbitrary command execution.

Content

Scanner excerpt · scripts/ecosystems.py (reported line 61)May include surrounding context.

python
# Execute Skills CLI search
            cmd = f'npx skills find "{search_terms}" --json'
            result = subprocess.run(
                cmd, 
                shell=True, 
                capture_output=True,

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The code transmits user search content to a third-party service (Clawhub) without explicit notice or consent. This is primarily a privacy and data-handling issue rather than code execution, but it can expose sensitive prompts, internal project names, or proprietary task descriptions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The code sends user-derived search text to GitHub's API without explicit disclosure. This can leak sensitive intent or internal terminology to an external party, even though the transmission is over HTTPS and not directly executable.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
78% confidence
Finding

This line performs an outbound request to GitHub containing user-derived search data. In the context of a skill finder this behavior is expected, but it still creates an external data exposure channel that matters if users may search for confidential topics.

Content

Scanner excerpt · scripts/ecosystems.py (reported line 236)May include surrounding context.

python
search_query = f"{keywords} topic:agent-skill"
            encoded_query = urllib.parse.quote(search_query)
            url = f"https://api.github.com/search/repositories?q={encoded_query}&sort=stars&order=desc&per_page=5"
            
            req = urllib.request.Request(url)
            req.add_header('User-Agent', 'Smart-Skill-Finder/1.0')