ClawHub
Back to skill

Security audit

Test Sentinel

Security checks for vulnerabilities and agentic risk

Overview

This testing skill is review-worthy because it can automatically change code, run unpinned npm tools, and commit broad repository changes without an approval step.

Install only if you are comfortable with an agent modifying source files and potentially creating commits. Prefer using it in a clean working tree, with locked local devDependencies, and review diffs/status before allowing any commit or repository-wide formatter write.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:118
Finding

Unpinned package execution through npx

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:118-133
Vulnerability Type: Unpinned third-party package execution
Risk Level: Medium

Vulnerable Code

bash
npx vitest run && npx playwright test
bash
npx vitest --watch
bash
npx vitest run src/lib/__tests__/utils.test.ts
bash
npx vitest run --coverage

Additional unpinned npx invocations occur at SKILL.md:152-158 and SKILL.md:211.

Technical Analysis

The Skill instructs the agent to execute named packages through npx without requiring that they already exist in the audited project's locked dependency tree. Depending on the installed npm/npx version and configuration, an absent package may be resolved from the configured package registry and executed.

This introduces a supply-chain execution path not required for local testing. The Skill does not validate package versions, lockfile integrity, package provenance, or registry configuration before execution. Although no malicious dependency is bundled by this project, the instructions permit mutable third-party code to execute with the agent's privileges.

Attack Path

  1. The target project does not have one of the requested packages installed locally, or dependency resolution is influenced by a malicious registry configuration.
  2. The agent follows the Skill and invokes the package through npx.
  3. npx resolves and downloads the package from the active registry.
  4. Package lifecycle logic or the package CLI executes with the same privileges as the agent process.
  5. A compromised or substituted package can read accessible project files, modify the workspace, access environment variables available to the process, or initiate network connections.

Impact Assessment

Successful exploitation would provide code execution under the agent's operating-system account. The practical scope includes files and environment data accessible to th ...[truncated 247 chars]

Remediation
View remediation

Remediation Suggestions

  • Require all testing and linting tools to be declared in the target project's dependency manifest and pinned by a committed lockfile.
  • Prevent implicit downloads by using npx --no-install, or the equivalent package-manager option that executes only locally installed binaries.
  • Verify lockfile integrity and the expected package registry before running third-party tools.
  • Avoid automatically installing missing dependencies. Report missing tools and request explicit user authorization instead.
  • Where supported, use deterministic package-manager commands such as npm exec --offline -- vitest run.
  • Run test tooling in a sandbox with restricted filesystem access, limited environment variables, and outbound network access disabled unless explicitly required.

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:145
Finding

Broad autonomous Git staging and commit can capture unrelated sensitive files

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:145
Vulnerability Type: Unsafe repository-wide staging and autonomous commit
Risk Level: Medium

Vulnerable Code

bash
git add -A && git commit -m "test: fix <description>"

Technical Analysis

git add -A stages every tracked modification, deletion, and untracked file visible in the repository rather than limiting the operation to files intentionally changed by the testing task. The subsequent commit records all staged content in Git history.

Committing changes is not necessary to perform the Skill's declared testing, linting, or repair functions. The instruction therefore exceeds minimum privilege and change scope. It also lacks a review step, a sensitive-file check, path restrictions, or explicit user approval.

No automatic push is instructed, so this does not by itself transmit data over the network. Nevertheless, committing a secret or unrelated file can preserve it in repository history and make later disclosure more likely if the repository is subsequently pushed by the user or another process.

Attack Path

  1. The target repository contains unrelated user modifications or an untracked sensitive file, such as a local configuration file, generated credential, or debugging artifact.
  2. The Skill modifies code while fixing a test, lint, or type-check failure.
  3. The agent follows the instruction to run git add -A.
  4. Git stages both the intended repair and all unrelated repository changes.
  5. The agent creates a commit containing the entire staged set.
  6. Sensitive content becomes persistent in local Git history and may later be disclosed if that history is pushed or shared.

Impact Assessment

The issue can affect all tracked and untracked content within the repository. It may cause loss of change separation, unauthorized inclusion of user work, and persistent storage of sensitive files in Git history. It does not ...[truncated 120 chars]

Remediation
View remediation

Remediation Suggestions

  • Remove automatic commit behavior from the default workflow.
  • Require explicit user approval before staging or committing any changes.
  • Track the exact files intentionally created or modified by the Skill and stage only those paths with git add -- <approved-paths>.
  • Display git status --short and the complete proposed diff before requesting approval.
  • Scan proposed additions for common secret and credential patterns before staging.
  • Refuse to stage sensitive files such as environment files, private keys, credential exports, and local configuration containing secrets.
  • Preserve unrelated working-tree changes and report them to the user rather than including them in the Skill's commit.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (13)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill explicitly instructs autonomous source-code modification when tests reveal a code bug, but it does not require a user-facing warning or confirmation before altering repository files. This is risky because a user invoking a testing skill may not expect production code to be changed automatically based on test outcomes.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
90% confidence
Finding

The skill instructs use of npx vitest and npx playwright without pinning versions. npx may fetch and execute the latest package version or a package influenced by registry/project state, creating a supply-chain risk where unreviewed code is executed during testing.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
90% confidence
Finding

The skill instructs use of npx vitest and npx playwright without pinning versions. npx may fetch and execute the latest package version or a package influenced by registry/project state, creating a supply-chain risk where unreviewed code is executed during testing.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
89% confidence
Finding

Using bare npx vitest --watch can cause execution of an unpinned tool version from the registry or environment. In an autonomous skill that runs commands, this increases the chance of supply-chain compromise or unexpected behavior across environments.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
89% confidence
Finding

The command npx vitest run src/lib/__tests__/utils.test.ts relies on an unpinned executable. If the package is absent or overridden, npx can retrieve and run an unintended version, undermining the integrity of test execution.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
89% confidence
Finding

Running npx vitest run --coverage without a pinned version exposes the skill to the same package-resolution and remote execution risks as other bare npx commands. Because the skill is designed to act autonomously, users may not realize external code could be fetched and run.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill grants itself authority to run git add -A && git commit -m ..., which is beyond merely writing and running tests because it changes repository history. In an autonomous agent, this can hide unauthorized code changes, package updates, or other side effects behind a routine testing workflow.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill includes git add -A && git commit -m ... without any confirmation gate. In this context, the danger is heightened because the skill is user-invocable and autonomous, so it can both modify files and permanently record those changes in version history without informed consent.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
88% confidence
Finding

The skill recommends npx prettier --check . without pinning the prettier version. In automated workflows, this can pull and execute an unreviewed package version, creating supply-chain exposure and inconsistent results.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
88% confidence
Finding

The skill recommends npx prettier --check . without pinning the prettier version. In automated workflows, this can pull and execute an unreviewed package version, creating supply-chain exposure and inconsistent results.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
88% confidence
Finding

The command npx prettier --write . executes an unpinned formatter that can rewrite many files. If npx resolves to an unintended package version, it could cause widespread unauthorized file modifications or execute compromised code.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
88% confidence
Finding

The command npx prettier --write . executes an unpinned formatter that can rewrite many files. If npx resolves to an unintended package version, it could cause widespread unauthorized file modifications or execute compromised code.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
86% confidence
Finding

Using npx tsc --noEmit without pinning the TypeScript version permits execution of an unexpected compiler version. While lower risk than write-capable commands, it still introduces supply-chain and environment-integrity concerns in autonomous tooling.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.