ClawHub
Back to skill

Security audit

Performance Optimization

Security checks for vulnerabilities and agentic risk

Overview

This is a documentation-only performance skill with ordinary web and LLM cost-optimization examples, though users should pin the shown CLI tool and handle prompts sent to APIs carefully.

Before installing, treat this as general optimization guidance. If you follow the Lighthouse command, pin the package version or run it in an isolated environment. If you implement the LLM examples, review provider data handling, redact sensitive content, and avoid sending confidential prompts or user data unless approved.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:351
Finding

Unpinned Third-Party Package Execution via npx

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:351
Vulnerability Type: Unpinned third-party dependency execution
Risk Level: Medium

bash
# Lighthouse CLI
npx lighthouse https://example.com --output html --output-path report.html

Technical Analysis

The documented command invokes lighthouse through npx without specifying an exact package version. If the package is not already available locally, npx may resolve, download, and execute the version currently served by the configured package registry. The project provides no lockfile, integrity verification, trusted-registry requirement, or reviewed installation step to constrain that resolution.

This creates a supply-chain trust boundary in which the code executed by the command can change after the Skill has been reviewed. A compromised package release, registry account, registry mirror, or package-resolution configuration could therefore cause arbitrary package lifecycle or CLI code to run.

The behavior is not required at this privilege level to provide performance-audit guidance. The documentation could instead reference a reviewed, exactly pinned dependency and require explicit installation before execution.

Attack Path

  1. An attacker compromises the upstream package publication process, a configured registry or mirror, or another relevant dependency in the resolved package tree.
  2. A malicious or compromised package version becomes the version selected by the unpinned npx lighthouse command.
  3. A user follows the command in SKILL.md.
  4. npx downloads and executes the selected package in the user's environment.
  5. Malicious package code runs with the permissions of the invoking user and can access resources available to that account.

Impact Assessment

Successful exploitation can execute arbitrary code with the invoking user's privileges. Depending on the execution environment, this may permit access to user-readable files ...[truncated 500 chars]

Remediation
View remediation

Remediation Suggestions

  • Pin Lighthouse to an exact, reviewed version, for example:
    bash
    npx --yes lighthouse@X.Y.Z https://example.com --output html --output-path report.html
  • Prefer declaring the exact package version in a project manifest and committing the corresponding lockfile.
  • Install dependencies with a lockfile-enforcing command such as npm ci, then invoke the reviewed local binary.
  • Configure an approved package registry and validate lockfile integrity metadata.
  • Use automated dependency scanning and controlled update review before changing the pinned version.
  • Run performance-audit tooling in an isolated, least-privileged environment without unnecessary credentials or access to sensitive files.
  • Avoid presenting commands that implicitly download and execute the latest package version.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (5)

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 51)May include surrounding context.

Preload critical resources:

html
<!-- LCP image -->
<link rel="preload" href="/hero.webp" as="image" fetchpriority="high">

<!-- Critical font -->

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 305)May include surrounding context.

Load strategies

javascript
// ❌ Blocks main thread
<script src="https://analytics.example.com/script.js"></script>

// ✅ Async loading
<script async src="https://analytics.example.com/script.js"></script>

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 308)May include surrounding context.

Load strategies

javascript
// ❌ Blocks main thread
<script src="https://analytics.example.com/script.js"></script>

// ✅ Async loading
<script async src="https://analytics.example.com/script.js"></script>

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The LLM cost-optimization examples send raw systemPrompt and text/user input to an external API without any accompanying warning about data handling, privacy boundaries, or suitability of sending sensitive content. In a skill meant to guide implementation, this omission can normalize unsafe transmission of secrets, personal data, or proprietary prompts to third-party providers.

Content

No source excerpt is available for this finding.