ClawHub
Back to skill

Security audit

Factory

Security checks for vulnerabilities and agentic risk

Overview

This installer skill is mostly transparent about its purpose, but it directs broad, persistent, unpinned third-party installations and includes a direct remote script execution command.

Review the upstream repositories and package sources before installing. Prefer pinned versions or immutable commits, avoid running the curl-to-sh command, and only enable the Claude plugin, hooks, or solograph MCP server if you are comfortable with user-scoped persistent tooling that may access project code, session history, and knowledge-base content.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:167
Finding

Remote Installer Downloaded and Executed Without Integrity Verification

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:167 Vulnerability Type: Remote payload retrieval and direct shell execution Risk Level: Critical

Vulnerable Code:

bash
curl -LsSf https://astral.sh/uv/install.sh | sh

Technical Analysis

The troubleshooting instructions pipe the response from an external URL directly into sh. The retrieved script is not pinned to an immutable version and is not inspected or verified using a cryptographic checksum or signature before execution.

Although the URL appears to be the official installer endpoint for uv, the effective payload is mutable and resides outside this audited project. Consequently, the code that will execute may differ from the code available at audit time. Compromise of the upstream server, publishing process, DNS resolution, certificate infrastructure, or network path could turn this instruction into an arbitrary-code-execution channel.

Direct execution also prevents the user from reviewing the downloaded content before it runs. This behavior exceeds the minimum privileges required to explain how to install a prerequisite safely.

Attack Path

  1. An attacker compromises the remote installer endpoint, its deployment process, or another component of the delivery chain.
  2. The user or Agent encounters the documented uvx: command not found condition.
  3. The Agent follows the remediation instruction and executes the curl | sh pipeline.
  4. curl retrieves the attacker-controlled response.
  5. The response is immediately interpreted by the local shell without integrity verification or review.
  6. The payload performs arbitrary actions with the privileges of the user running the Agent.

Impact Assessment

Successful exploitation provides arbitrary command execution under the invoking user's account. The resulting payload could read or modify user-accessible files, steal source code and credentials, alter shell or Agent configuration, in ...[truncated 380 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove the direct curl | sh installation instruction.
  2. Prefer a trusted operating-system package manager or another installation mechanism that supports version pinning and package-signature validation.
  3. If a standalone installer is necessary:
    • Pin an exact uv release.
    • Download the artifact to a local file without executing it.
    • Obtain the expected checksum or signature through a separately authenticated release channel.
    • Verify the artifact before execution.
    • Display the exact artifact, version, and intended changes to the user.
    • Require explicit user approval before running it.
  4. Execute installation with ordinary user privileges and never recommend sudo unless a separately justified operation requires it.
  5. Direct users to the official installation documentation rather than automatically executing mutable remote content.

T08 · Insecure Dependencies

Error
Location
SKILL.md:68
Finding

Unpinned Third-Party Skills, Plugins, and MCP Packages Are Installed or Executed

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:68, SKILL.md:96-97, SKILL.md:126, SKILL.md:131-139, and SKILL.md:145 Vulnerability Type: Unpinned third-party dependencies and executable integrations Risk Level: High

Vulnerable Code:

bash
npx skills add fortunto2/solo-factory --all
bash
claude plugin marketplace add https://github.com/fortunto2/solo-factory
claude plugin install solo@solo --scope user
bash
mcporter config add solograph --stdio "uvx solograph"
json
{
  "mcpServers": {
    "solograph": {
      "command": "uvx",
      "args": ["solograph"]
    }
  }
}
bash
uvx solograph --help

Technical Analysis

These commands install or execute third-party components without specifying immutable Git commits, exact package versions, verified hashes, or trusted signatures.

The npx installation path targets the current content associated with a GitHub repository and installs all available skills across detected Agent environments. The Claude Code path adds a mutable repository as a plugin marketplace and installs the plugin at user scope. The document states that this plugin includes hooks and MCP auto-start behavior, which broadens the execution surface beyond a one-time skill installation.

The MCP configuration invokes uvx solograph without a version constraint. uvx may retrieve and execute the package version currently resolved by its package source each time the command is launched. Merely running uvx solograph --help can trigger package retrieval and execution; --help does not make untrusted package initialization safe.

These dependencies may be legitimate, but their effective code cannot be established from this repository. The absence of immutable references means an upstream compromise or malicious future release could change behavior after this Skill has been reviewed.

Attack Path

  1. An attacker compromis ...[truncated 1749 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin every dependency to an exact, reviewed version:
    • Use an immutable Git commit rather than a mutable repository default branch.
    • Specify exact versions for solograph and tools invoked through npx or uvx.
    • Pin plugin marketplace and plugin content to immutable revisions where supported.
  2. Verify publisher signatures or cryptographic hashes before installation or execution.
  3. Maintain a reviewed lockfile or manifest containing all resolved transitive dependencies.
  4. Do not install all skills into every detected Agent by default. Ask the user to select the target Agent and required components.
  5. Separate consent for:
    • Installing skills.
    • Modifying user-scoped plugin configuration.
    • Installing hooks.
    • Enabling MCP auto-start.
    • Sending project or session information to an MCP process.
  6. Default to skills-only installation with MCP and persistent hooks disabled.
  7. Audit plugin hooks, MCP commands, package entry points, and requested tool permissions before enabling them.
  8. Run third-party MCP components with restricted filesystem, environment-variable, credential, and network access where sandboxing is available.
  9. Record the exact versions and integrity values installed so that subsequent verification and rollback are possible.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (13)

Missing User Warnings

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The curl-to-shell command downloads a remote installer script and pipes it directly to sh with no explicit warning or integrity verification. This is dangerous because any compromise of the hosting site, transport, or script contents leads to immediate arbitrary shell execution on the user's machine.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
94% confidence
Finding

npx skills add fortunto2/solo-factory --all fetches and executes remote package code without pinning an exact version or commit. That creates a supply-chain risk: a compromised upstream package, account, or newly published version could change what gets installed across multiple agents.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill includes network-based installation commands that modify the user's environment but does not provide an explicit warning about system changes, trust boundaries, or the fact that remote code will be executed. In an agent skill context, omission of that warning is riskier because users may treat setup steps as endorsed automation.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
91% confidence
Finding

uvx solograph runs a remotely resolved Python package without an explicit pinned version. Since this configures an MCP server that may later access code, sessions, and search functionality, an upstream compromise could lead to persistent execution of attacker-controlled tooling.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
91% confidence
Finding

The verification step uvx solograph --help still resolves and runs the package if it is not already present, so it remains subject to unpinned supply-chain risk. Although framed as a harmless test, it can still execute attacker-controlled code from a mutable upstream source.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
92% confidence
Finding

The troubleshooting guidance again instructs users to run npx skills add fortunto2/solo-factory --all without a pinned version. Even though this is in the help section, it still directs execution of mutable remote code and carries the same supply-chain exposure.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
92% confidence
Finding

This line recommends npx skills add fortunto2/solo-factory --all as a fallback, again without version pinning. Because the skill is explicitly an installer for many other skills, the context amplifies the blast radius of any upstream package compromise.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
90% confidence
Finding

The troubleshooting note again advises uvx solograph --help without version pinning. Repeating this pattern in recovery guidance increases the chance users execute unverified remote code during troubleshooting.

Content

No source excerpt is available for this finding.

External Script Fetching

Low
Category
Supply Chain
Confidence
97% confidence
Finding

curl -LsSf https://astral.sh/uv/install.sh | sh is direct external script fetching and execution. This is a classic remote code execution pattern and is especially sensitive in a setup skill because users are primed to run commands that change their system state.

Content

Scanner excerpt · SKILL.md (reported line 167)May include surrounding context.

md
**Fix:** Use `npx skills add fortunto2/solo-factory --all` instead.

### uvx: command not found (for MCP)
**Fix:** `curl -LsSf https://astral.sh/uv/install.sh | sh`

### MCP tools not working
**Fix:** Test with `uvx solograph --help`. Check `.mcp.json` or mcporter config.

Static analysis

No suspicious patterns detected.