ClawHub
Back to skill

Security audit

Artifacts Builder Pro

Security checks for vulnerabilities and agentic risk

Overview

This skill is a conventional frontend project scaffolder and bundler, with expected package-install and file-writing behavior that users should run only in a suitable project workspace.

Install and run this only in a disposable or intended project directory, review the scripts first, and avoid running them from a shell with unrelated secrets or production credentials. Be aware that it may install pnpm globally, fetch many packages from the npm ecosystem, modify project files, and remove dist and bundle.html during bundling.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T08 · Insecure Dependencies

Warning
Location
scripts/init-artifact.sh:38
Finding

Unpinned npm Dependencies Allow Mutable Third-Party Code Execution During Project Initialization

Content
View full analysis

Vulnerability Details

File Location: scripts/init-artifact.sh:38, scripts/init-artifact.sh:57, scripts/init-artifact.sh:64, scripts/init-artifact.sh:73-74, and scripts/init-artifact.sh:278-279
Vulnerability Type: Supply-chain risk caused by unpinned dependencies and package tooling
Risk Level: Medium

Vulnerable Code

bash
npm install -g pnpm
bash
# Create new Vite project (always use latest create-vite, pin vite version later)
pnpm create vite "$PROJECT_NAME" --template react-ts
bash
echo "📦 Installing base dependencies..."
pnpm install
bash
echo "📦 Installing Tailwind CSS and dependencies..."
pnpm install -D tailwindcss@3.4.1 postcss autoprefixer @types/node tailwindcss-animate
pnpm install class-variance-authority clsx tailwind-merge lucide-react next-themes
bash
# Install all shadcn/ui dependencies
echo "📦 Installing shadcn/ui dependencies..."
pnpm install @radix-ui/react-accordion @radix-ui/react-aspect-ratio @radix-ui/react-avatar @radix-ui/react-checkbox @radix-ui/react-collapsible @radix-ui/react-context-menu @radix-ui/react-dialog @radix-ui/react-dropdown-menu @radix-ui/react-hover-card @radix-ui/react-label @radix-ui/react-menubar @radix-ui/react-navigation-menu @radix-ui/react-popover @radix-ui/react-progress @radix-ui/react-radio-group @radix-ui/react-scroll-area @radix-ui/react-select @radix-ui/react-separator @radix-ui/react-slider @radix-ui/react-slot @radix-ui/react-switch @radix-ui/react-tabs @radix-ui/react-toast @radix-ui/react-toggle @radix-ui/react-toggle-group @radix-ui/react-tooltip
pnpm install sonner cmdk vaul embla-carousel-react react-day-picker react-resizable-panels date-fns react-hook-form @hookform/resolvers zod

Technical Analysis

The initialization script obtains pnpm, the Vite scaffolding tool, and numerous development and runtime dependencies without exact version constraints. As a result, identi ...[truncated 2132 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin pnpm, create-vite, and every direct dependency to reviewed exact versions rather than tags or unconstrained versions.
  2. Avoid global installation. Invoke a pinned package-manager version through Corepack or document a verified local installation procedure.
  3. Provide a reviewed lockfile and enforce it with pnpm install --frozen-lockfile.
  4. Maintain a version-controlled template instead of dynamically resolving the latest Vite scaffold.
  5. Use --ignore-scripts where dependency lifecycle scripts are unnecessary. Explicitly review and allow required build scripts.
  6. Enable package integrity and provenance verification where supported.
  7. Run dependency installation in a sandbox or least-privileged build environment without production credentials.
  8. Add automated dependency auditing and controlled update reviews before changing pinned versions.

T08 · Insecure Dependencies

Warning
Location
scripts/bundle-artifact.sh:18
Finding

Bundling Script Installs Unpinned Build Tools Before Processing Project Files

Content
View full analysis

Vulnerability Details

File Location: scripts/bundle-artifact.sh:18-20
Vulnerability Type: Supply-chain risk caused by unpinned build dependencies
Risk Level: Medium

Vulnerable Code

bash
# Install bundling dependencies
echo "📦 Installing bundling dependencies..."
pnpm add -D parcel @parcel/config-default parcel-resolver-tspaths html-inline

Technical Analysis

The bundling script installs Parcel, its default configuration, a path resolver, and html-inline without exact versions before every build. This allows the effective build-tool implementation and transitive dependency graph to change after the Skill has been reviewed.

Installation can execute package lifecycle scripts. The installed tools are then immediately invoked to parse, compile, and inline project files, giving a compromised tool an additional execution path beyond installation hooks. Because the generated bundle.html is intended for sharing, malicious build behavior could also inject content into the distributed output.

The packages are retrieved through the conventional package ecosystem, and the reviewed code contains no evidence of a currently malicious package. The vulnerability is the absence of dependency immutability and controlled verification.

Attack Path

  1. An attacker compromises an unpinned bundling package or one of its transitive dependencies.
  2. A malicious mutable release is published to the configured package registry.
  3. A user runs scripts/bundle-artifact.sh in a project directory.
  4. pnpm add -D resolves and installs the compromised release.
  5. Malicious code executes through an installation lifecycle hook or when Parcel or html-inline is invoked.
  6. The attacker-controlled code can access the build environment, alter project files, or inject content into bundle.html.

Impact Assessment

Successful exploitation could execute arbitrary code with the permissions of the user perfor ...[truncated 408 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin all bundling tools to reviewed exact versions.
  2. Declare the tools in a version-controlled package.json and commit the corresponding lockfile.
  3. Replace the runtime pnpm add -D operation with pnpm install --frozen-lockfile.
  4. Use --ignore-scripts where practical and explicitly approve packages that require lifecycle scripts.
  5. Perform builds in an isolated, least-privileged environment without unrelated credentials or sensitive mounts.
  6. Verify package integrity and provenance before installation.
  7. Scan the resulting bundle.html for unexpected external URLs, scripts, and injected content before distribution.
  8. Apply controlled dependency updates only after security review and reproducibility testing.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill explicitly instructs the agent to run local shell scripts that create a project, change directories, install/build dependencies, and generate output files, but it does not warn about filesystem changes, network package installation, or the trust boundary of executing repository-provided scripts. In an agent setting, this can lead to unintended code execution, file modification, or dependency fetches without clear user awareness or confirmation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The script performs a destructive file operation by recursively deleting dist and bundle.html. Although there is a generic "Cleaning previous build..." log message, it does not clearly disclose to the user which paths will be removed before the deletion occurs.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.