ClawHub
Back to skill

Security audit

Jack Cloud

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent Jack Cloud deployment guide with disclosed cloud, credential, and source-upload behavior that matches its purpose.

Install only if you are comfortable using the Jack CLI to authenticate with GitHub or Google, store a local auth token, upload project source code to Jack Cloud during deployment, and make cloud-side changes such as database writes, secrets, storage buckets, cron schedules, and domains. Consider pinning or otherwise verifying the npm package before installing, and test destructive SQL examples on non-production data first.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:14
Finding

Unpinned Global npm Package Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 14-18
Vulnerability Type: Unpinned third-party dependency installed globally
Risk Level: Medium

Vulnerable Code

bash
## Install

npm i -g @getjack/jack
jack login

The package is also declared without a version constraint in the Skill metadata:

yaml
metadata: {"clawdbot":{"emoji":"🃏","homepage":"https://github.com/getjack-org/skills","requires":{"bins":["node","npm"],"env":[]},"install":[{"id":"npm","kind":"npm","package":"@getjack/jack","bins":["jack"],"label":"Install Jack CLI (npm)"}]}}

Technical Analysis

The Skill instructs users or agents to install the latest available version of @getjack/jack globally. No exact version, lockfile, integrity hash, or provenance-verification mechanism is specified.

npm packages and their transitive dependencies can execute lifecycle scripts during installation. Consequently, compromise of the package publisher, npm account, published package, or dependency chain could cause attacker-controlled code to execute with the permissions of the user running the installation. Because the installation is global, it can also create or replace executables in the user's global npm binary path.

This finding identifies an unsafe dependency-installation pattern; the audited files contain no evidence that the named package is currently malicious.

Attack Path

  1. An attacker compromises the package publisher, npm account, release process, or a transitive dependency.
  2. The attacker publishes a malicious version that becomes the version selected by the unpinned installation command.
  3. A user or agent follows the Skill instructions and runs npm i -g @getjack/jack.
  4. npm downloads the compromised package and may execute its lifecycle scripts.
  5. The malicious code runs with the invoking user's privileges and may install or replace a globally accessible executable.
  6. Subsequent invocations ...[truncated 624 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin the CLI to a reviewed exact version, for example @getjack/jack@X.Y.Z, rather than installing the latest release implicitly.
  2. Prefer a project-local dependency governed by a committed lockfile instead of a global installation.
  3. Use deterministic installation methods such as npm ci where applicable.
  4. Verify package provenance, publisher identity, signatures or attestations, and registry integrity metadata before installation.
  5. Review package and transitive-dependency lifecycle scripts before approving upgrades.
  6. Run installation in an isolated, non-privileged environment and explicitly warn users not to execute it with administrator or root privileges.
  7. Use automated dependency scanning and a controlled upgrade process for future versions.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
89% confidence
Finding

This markdown file includes example code that deletes session records in scheduled jobs and routes, but the surrounding documentation does not warn that the operation is destructive or irreversible for matching data. For markdown files, safety-impacting behaviors affecting user data should be disclosed clearly in the skill description.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.