ClawHub
Back to skill

Security audit

plsreadme

Security checks for vulnerabilities and agentic risk

Overview

This skill is understandable and not deceptive, but it can publish local documents to permanent public links and its install instructions run an unpinned MCP package.

Install only if you are comfortable with markdown or text being uploaded to a public, permanent link. Before using it, prefer a pinned reviewed version of the MCP server or a constrained remote endpoint, and require explicit confirmation for every upload, especially for notes, PRDs, proposals, internal docs, or files selected by path.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:14
Finding
Unpinned Third-Party Package Execution Through npx## Vulnerability Details **File Location**: `SKILL.md`, lines 14–23 **Vulnerability Type**: Insecure third-party dependency execution **Risk Level**: Medium ### Vulnerable Code ```json { "mcpServers": { "plsreadme": { "command": "npx", "args": ["-y", "plsreadme-mcp"] } } } ``` ### Technical Analysis The recommended configuration invokes `npx` with the unversioned `plsreadme-mcp` package and the `-y` option. This permits npm to retrieve and execute the registry's current package version without interactive confirmation, an exact version constraint, integrity verification, or documented provenance validation. The reviewed package does not itself contain an embedded malicious script, and there is no evidence that `plsreadme-mcp` is currently malicious. The weakness is a supply-chain trust issue: the effective executable can change after this Skill has been reviewed. If the npm package, publisher account, release process, or registry resolution path is compromised, users following these instructions could execute attacker-controlled code with the privileges of the MCP client process. ### Attack Path 1. An attacker compromises the `plsreadme-mcp` publisher account, release pipeline, or another relevant package-distribution component. 2. The attacker publishes a malicious release under the package name resolved by npm. 3. A user copies the documented MCP configuration and starts or reloads the MCP client. 4. `npx -y plsreadme-mcp` retrieves the registry-selected release without requiring interactive approval. 5. Package installation hooks or runtime initialization code executes with the operating-system privileges and environment of the user running the MCP client. 6. The malicious code can access resources available to that process and perform actions permitted by the user's account. ### Impact Assessment Successful exploitation can provide arbitrary code execution under the account running the MCP client. Depending on that account's ...[truncated 394 chars]
Remediation
## Remediation Suggestions 1. Replace the floating package reference with an exact, reviewed version, for example `plsreadme-mcp@X.Y.Z`. 2. Install the dependency through a controlled project manifest and commit a lockfile containing resolved versions and integrity hashes rather than downloading a floating release at every launch. 3. Verify the package's official npm namespace, source repository, maintainers, release provenance, and integrity before deployment. 4. Avoid `-y` where practical so unexpected installation or resolution behavior is not accepted automatically. 5. Prefer a preinstalled, reviewed executable referenced by an explicit local path. 6. Run the MCP server in a sandbox or restricted account with minimal filesystem access, no unnecessary secrets in its environment, and constrained outbound network access. 7. Establish an update process in which newer versions are reviewed and tested before the pinned version is changed.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Rp1

Medium
Category
MCP Rug Pull
Confidence
91% confidence
Finding
The manifest metadata references the MCP server requirement without a pinned version, which can lead downstream users or tooling to install and execute whatever package version is current at the time. Because this is part of the skill definition itself, it normalizes unsafe installation behavior and exposes users to package takeover or malicious update scenarios.

Rp1

Medium
Category
MCP Rug Pull
Confidence
93% confidence
Finding
The skill instructs users to run an MCP server via `npx plsreadme-mcp` without pinning an exact package version. This creates a supply-chain risk: a future malicious or compromised package release could be fetched and executed automatically, and MCP servers typically get access to local files and user-provided content, increasing the blast radius.

Vague Triggers

Medium
Confidence
93% confidence
Finding
The trigger phrases are broad enough to match common requests like sharing a document, creating a preview link, or making content readable, which can cause the skill to activate in many ordinary contexts. In this skill, activation matters because the core action publishes content to a permanent public link, so overbroad routing raises the chance of accidental disclosure of sensitive markdown, notes, or internal documents.

Static analysis

No suspicious patterns detected.