ClawHub
Back to skill

Security audit

plsreadme

Security checks for vulnerabilities and agentic risk

Overview

This skill is understandable and not deceptive, but it can publish local documents to permanent public links and its install instructions run an unpinned MCP package.

Install only if you are comfortable with markdown or text being uploaded to a public, permanent link. Before using it, prefer a pinned reviewed version of the MCP server or a constrained remote endpoint, and require explicit confirmation for every upload, especially for notes, PRDs, proposals, internal docs, or files selected by path.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:14
Finding

Unpinned Third-Party Package Execution Through npx

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 14–23
Vulnerability Type: Insecure third-party dependency execution
Risk Level: Medium

Vulnerable Code

json
{
  "mcpServers": {
    "plsreadme": {
      "command": "npx",
      "args": ["-y", "plsreadme-mcp"]
    }
  }
}

Technical Analysis

The recommended configuration invokes npx with the unversioned plsreadme-mcp package and the -y option. This permits npm to retrieve and execute the registry's current package version without interactive confirmation, an exact version constraint, integrity verification, or documented provenance validation.

The reviewed package does not itself contain an embedded malicious script, and there is no evidence that plsreadme-mcp is currently malicious. The weakness is a supply-chain trust issue: the effective executable can change after this Skill has been reviewed. If the npm package, publisher account, release process, or registry resolution path is compromised, users following these instructions could execute attacker-controlled code with the privileges of the MCP client process.

Attack Path

  1. An attacker compromises the plsreadme-mcp publisher account, release pipeline, or another relevant package-distribution component.
  2. The attacker publishes a malicious release under the package name resolved by npm.
  3. A user copies the documented MCP configuration and starts or reloads the MCP client.
  4. npx -y plsreadme-mcp retrieves the registry-selected release without requiring interactive approval.
  5. Package installation hooks or runtime initialization code executes with the operating-system privileges and environment of the user running the MCP client.
  6. The malicious code can access resources available to that process and perform actions permitted by the user's account.

Impact Assessment

Successful exploitation can provide arbitrary code execution under the account running the MCP client. Depending on that account's ...[truncated 394 chars]

Remediation
View remediation

Remediation Suggestions

  1. Replace the floating package reference with an exact, reviewed version, for example plsreadme-mcp@X.Y.Z.
  2. Install the dependency through a controlled project manifest and commit a lockfile containing resolved versions and integrity hashes rather than downloading a floating release at every launch.
  3. Verify the package's official npm namespace, source repository, maintainers, release provenance, and integrity before deployment.
  4. Avoid -y where practical so unexpected installation or resolution behavior is not accepted automatically.
  5. Prefer a preinstalled, reviewed executable referenced by an explicit local path.
  6. Run the MCP server in a sandbox or restricted account with minimal filesystem access, no unnecessary secrets in its environment, and constrained outbound network access.
  7. Establish an update process in which newer versions are reviewed and tested before the pinned version is changed.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Rp1

Medium
Category
MCP Rug Pull
Confidence
91% confidence
Finding

The manifest metadata references the MCP server requirement without a pinned version, which can lead downstream users or tooling to install and execute whatever package version is current at the time. Because this is part of the skill definition itself, it normalizes unsafe installation behavior and exposes users to package takeover or malicious update scenarios.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
93% confidence
Finding

The skill instructs users to run an MCP server via npx plsreadme-mcp without pinning an exact package version. This creates a supply-chain risk: a future malicious or compromised package release could be fetched and executed automatically, and MCP servers typically get access to local files and user-provided content, increasing the blast radius.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The trigger phrases are broad enough to match common requests like sharing a document, creating a preview link, or making content readable, which can cause the skill to activate in many ordinary contexts. In this skill, activation matters because the core action publishes content to a permanent public link, so overbroad routing raises the chance of accidental disclosure of sensitive markdown, notes, or internal documents.

Content

No source excerpt is available for this finding.