ClawHub
Back to skill

Security audit

TokenLab OpenAI Migration

Security checks for vulnerabilities and agentic risk

Overview

This skill is a narrow migration helper for TokenLab integrations, with no embedded executable payload or hidden persistence, but users should prefer a pinned install source.

Before installing, consider pinning the skill source to a reviewed commit and avoiding non-interactive `-y` installation. When using the skill, review the generated diff and keep API keys in environment variables rather than source files.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
README.md:8
Finding

Unpinned Third-Party Skill Installation from Mutable Remote Sources

Content
View full analysis

Vulnerability Details

File Location: README.md, line 8
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Complete Code Snippet:

bash
npx skills add https://github.com/hedging8563/tokenlab-skills --skill tokenlab-openai-compatible-migration -y

Technical Analysis

The documented installation command invokes the skills npm package through npx without specifying a package version and installs Skill content from a GitHub repository without pinning a tag or immutable commit hash. Both dependencies can therefore resolve to content different from what was reviewed during this audit.

The -y argument enables non-interactive confirmation, reducing the opportunity for a user to inspect unexpected installation behavior or changed remote content. If the npm package, its dependency chain, the GitHub account, or the repository is compromised, the command could retrieve and install attacker-controlled content.

This finding concerns the installation process documented by the project. The audited repository itself contains no embedded executable scripts or confirmed malicious payload.

Attack Path

  1. An attacker compromises the npm package, one of its transitive dependencies, the GitHub account, or the referenced repository.
  2. The attacker publishes a modified installer or adds malicious Skill instructions or files to the mutable repository branch.
  3. A user follows the README and executes the unpinned npx skills add command.
  4. npx retrieves the currently available package version, and the installer retrieves the current repository content rather than an audited immutable revision.
  5. The -y option allows installation to proceed without interactive confirmation.
  6. The altered Skill is installed and may affect agent behavior or, depending on installer and payload capabilities, perform actions with the permissions of the invoking user.

Impact Assessment

Exploitati ...[truncated 634 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin the skills npm package to a reviewed, explicit version rather than allowing npx to resolve the latest release.
  2. Pin the GitHub source to an immutable commit hash or a cryptographically verified signed release instead of a mutable default branch.
  3. Publish and verify checksums or signatures for released Skill artifacts.
  4. Remove -y where practical so users can review installation prompts and resolved sources.
  5. Document the expected npm package version, repository commit, artifact checksum, and verification procedure.
  6. Use lockfiles and integrity metadata for all applicable npm dependencies.
  7. Run installation with least privilege in an isolated environment, and avoid exposing unrelated credentials to the installer process.
  8. Add automated release checks that compare distributed artifacts against the reviewed repository revision.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (6)

Rp1

Medium
Category
MCP Rug Pull
Confidence
91% confidence
Finding

The README instructs users to run npx skills add ... without pinning a specific package or tool version, which can cause different code to be fetched and executed over time. In a supply-chain compromise or malicious update scenario, users following the install command could unknowingly execute attacker-controlled code.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 24)May include surrounding context.

md
## Default migration rules

- OpenAI-compatible SDKs:
  - base URL: `https://api.tokenlab.sh/v1`
  - auth: `Authorization: Bearer $TOKENLAB_API_KEY`
  - chat path: `/v1/chat/completions`
- Anthropic-native clients:

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 34)May include surrounding context.

md
## Default migration rules

- OpenAI-compatible SDKs:
  - base URL: `https://api.tokenlab.sh/v1`
  - auth: `Authorization: Bearer $TOKENLAB_API_KEY`
  - chat path: `/v1/chat/completions`
- Anthropic-native clients:

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 35)May include surrounding context.

md
## Default migration rules

- OpenAI-compatible SDKs:
  - base URL: `https://api.tokenlab.sh/v1`
  - auth: `Authorization: Bearer $TOKENLAB_API_KEY`
  - chat path: `/v1/chat/completions`
- Anthropic-native clients:

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 36)May include surrounding context.

md
## Default migration rules

- OpenAI-compatible SDKs:
  - base URL: `https://api.tokenlab.sh/v1`
  - auth: `Authorization: Bearer $TOKENLAB_API_KEY`
  - chat path: `/v1/chat/completions`
- Anthropic-native clients:

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 63)May include surrounding context.

md
- Do not flatten native Anthropic or Gemini payloads into generic chat unless the user explicitly accepts that behavior change.
- Do not silently change models when the user's existing model has no obvious TokenLab equivalent.
- Do not embed API keys in source files or prompts.
- Do not claim feature parity without checking the model details endpoint.

## Edge Cases

Static analysis

No suspicious patterns detected.