ClawHub
Back to skill

Security audit

botauth

Security checks for vulnerabilities and agentic risk

Overview

This skill transparently helps an agent retrieve secrets from a local botauth vault with desktop approval, but users should be careful about the unpinned global CLI install.

Install only a trusted, reviewed version of the botauth CLI, avoid running npm with elevated privileges, and understand that any agent using this skill can request vault metadata and sensitive fields subject to the botauth desktop approval flow.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
README.md:25
Finding

Unpinned Global Installation of a Third-Party CLI Package

Content
View full analysis

Vulnerability Details

File Location: README.md, lines 25-29
Vulnerability Type: Unpinned third-party dependency installed globally
Risk Level: Medium

Vulnerable Code:

markdown
## Install the CLI

```bash
npm install -g @botauth/cli
text

### Technical Analysis

The documentation instructs users to install the latest available version of `@botauth/cli` globally from the npm registry. It does not pin an exact reviewed version, verify package integrity or provenance, or provide a lockfile.

Consequently, the code installed and executed can differ from the version assessed when the Skill was published. If the package, publisher account, or distribution channel is compromised, a malicious release could execute npm lifecycle scripts during installation and install an attacker-controlled `botauth` executable on the user's global `PATH`.

This risk is especially significant because the Skill subsequently directs the agent to use this CLI to retrieve API keys, tokens, passwords, and other sensitive fields from an unlocked vault.

### Attack Path

1. An attacker compromises the npm package, its publisher account, or another part of its release pipeline.
2. The attacker publishes a malicious version under the legitimate `@botauth/cli` package name.
3. A user follows the README and runs `npm install -g @botauth/cli`.
4. npm selects the malicious latest version because no exact version or integrity value is specified.
5. Malicious lifecycle code executes with the privileges of the user running npm, or a malicious `botauth` executable is placed on the global `PATH`.
6. The agent later invokes commands such as `botauth get --id <id> --fields api_key`.
7. The compromised CLI can capture retrieved credentials, alter command output, access files available to the user, or transmit sensitive data to an attacker-controlled service.

### Impact Assessment

Successful exploitation can provide code execu
...[truncated 522 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin the CLI to an exact, reviewed version, for example:
    bash
    npm install -g @botauth/cli@0.1.0
  2. Document how users can verify package ownership, release provenance, signatures, and published integrity hashes before installation.
  3. Prefer a project-local installation with a committed lockfile over a global installation where operationally possible.
  4. Avoid running npm with administrator or root privileges.
  5. Review the selected package version and its lifecycle scripts before recommending it.
  6. Consider disabling lifecycle scripts during installation when compatible with the package:
    bash
    npm install --ignore-scripts @botauth/cli@<reviewed-version>
  7. Ensure the expected executable path and package integrity are verified before allowing the CLI to handle vault credentials.
  8. Establish an update process in which each new version is reviewed and explicitly pinned rather than automatically consuming the latest registry release.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.