ClawHub
Back to skill

Security audit

代码引用

Security checks for vulnerabilities and agentic risk

Overview

This skill is a read-only Java caller-graph helper with one manageable supply-chain caution around an optional unpinned npx command.

Install is reasonable for read-only Java call-graph analysis. Before following the optional GitNexus indexing step, prefer a trusted preinstalled GitNexus binary or pin and verify the npm package version instead of running an unpinned npx command.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:55
Finding

Unpinned Third-Party Package Execution Through npx

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:55
Vulnerability Type: Unpinned third-party dependency execution
Risk Level: Medium

Vulnerable Code Snippet:

markdown
3. 索引过期时提示运行 `npx gitnexus analyze`，同时改用 rg 手工追溯。

Technical Analysis

The skill instructs the user to invoke gitnexus through npx without specifying an exact package version or verifying package integrity. If the package is not already installed locally, npx can retrieve executable package content from the configured npm registry.

This creates a supply-chain risk because the code executed at audit time may differ from the code originally reviewed. A compromised package release, compromised registry or maintainer account, dependency compromise, or package-name takeover could cause arbitrary package or lifecycle code to run locally.

The instruction only recommends the command and does not automatically execute it. Exploitation therefore requires a user or agent to follow the recommendation in an environment where package retrieval occurs.

Attack Path

  1. The repository's GitNexus index is missing or considered outdated.
  2. The skill recommends running npx gitnexus analyze.
  3. A user or agent executes the recommended command.
  4. npx resolves the unpinned package through the configured npm registry and may download it.
  5. A compromised or malicious package version executes with the invoking process's permissions.
  6. The package can access resources available to that user, including the current repository and other user-readable local data.

Impact Assessment

Successful exploitation could provide arbitrary code execution with the privileges of the user running npx. The accessible scope may include repository source code, environment variables, credentials available to the process, and user-writable files. No privilege-escalation mechanism, persistence mechanism, credential theft implementation, or confirmed m ...[truncated 67 chars]

Remediation
View remediation

Remediation Suggestions

  • Pin gitnexus to an exact, reviewed version rather than relying on mutable registry resolution.
  • Verify package provenance and integrity using an approved lockfile, integrity hash, or trusted internal registry.
  • Prefer a preinstalled and centrally managed GitNexus binary.
  • Require explicit user confirmation before downloading or executing third-party code.
  • Document the expected package publisher and official source to reduce dependency-confusion and typosquatting risks.
  • Retain the documented rg fallback so analysis can proceed without executing registry-fetched code.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Rp1

Medium
Category
MCP Rug Pull
Confidence
93% confidence
Finding

The skill instructs use of npx gitnexus analyze without pinning a specific package version. This can cause non-deterministic installs and exposes the environment to supply-chain risk if a newer or compromised package version is fetched at execution time. In this skill’s context, the command is only suggested as a fallback for repository indexing, which limits impact compared with direct automatic execution, but it is still unsafe guidance.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
96% confidence
Finding

The instruction "使用中文" forces a specific language for all outputs. This is a natural-language locale policy issue because the file does not offer the user a language choice or explain a justified region-specific constraint.

Content

No source excerpt is available for this finding.