ClawHub
Back to skill

Security audit

Data Viz

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward terminal charting guide, with ordinary but real caution around installing unpinned command-line packages and running example network requests.

Install only if you are comfortable fetching YouPlot and termgraph from public registries, preferably without admin privileges and in an isolated environment. Review or replace the sample curl URLs before running them, especially if adapting examples to private APIs or data.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:15
Finding

Unpinned Third-Party Packages Installed from Remote Registries

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 15-28
Vulnerability Type: Supply-chain exposure through unpinned dependencies
Risk Level: Medium

The Skill defines shell-based installation commands for YouPlot and termgraph without pinning reviewed package versions or verifying package integrity.

yaml
      "install":
        [
          {
            "id": "uplot-gem",
            "kind": "shell",
            "command": "gem install youplot",
            "bins": ["uplot"],
            "label": "Install YouPlot (Ruby gem)",
          },
          {
            "id": "termgraph-pip",
            "kind": "shell", 
            "command": "pip install termgraph",
            "bins": ["termgraph"],
            "label": "Install termgraph (Python)",
          },
        ],

Technical Analysis

The commands resolve package versions from external RubyGems and Python package registries at installation time. Because neither dependency is version-pinned and no cryptographic hash or lockfile is supplied, the effective installed code can change after the Skill has been audited.

Package installation may execute package-controlled build or installation logic. A compromised maintainer account, registry compromise, malicious future release, or compromised transitive dependency could therefore introduce arbitrary code. The issue is limited to supply-chain uncertainty; the audited file contains no evidence that the named packages are currently malicious.

Attack Path

  1. An attacker compromises the upstream package, its maintainer account, or a transitive dependency.
  2. The attacker publishes a malicious release under the expected package name.
  3. A user or Skill installation framework runs gem install youplot or pip install termgraph.
  4. The package manager resolves the attacker-controlled release because no reviewed version is pinned.
  5. Malicious installation logic or subs ...[truncated 602 chars]
Remediation
View remediation

Remediation Suggestions

  • Pin each dependency to a specifically reviewed version, such as an exact Ruby gem version and an exact Python package version.
  • Use package-manager integrity controls where available, including lockfiles, verified checksums, or hash-locked requirements.
  • Review and pin transitive dependencies as well as direct dependencies.
  • Configure trusted package registries explicitly and avoid fallback to untrusted or unexpected indexes.
  • Install Python dependencies in an isolated virtual environment and Ruby dependencies through a locked Bundler configuration.
  • Run installation without administrative privileges and with the minimum filesystem and network permissions required.
  • Establish a dependency-update process that re-audits new versions before changing the pins.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The manifest describes a skill for generating terminal charts from CSV/JSON data, but the documentation teaches users to fetch remote API data with curl and collect live system metrics with top before plotting. Those capabilities are not necessary to the stated visualization purpose and broaden the skill into network access and host inspection.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 78)May include surrounding context.

bash
# Extract data from JSON and plot
curl -s "https://api.example.com/data" | jq -r '.items[] | "\(.name),\(.value)"' | uplot bar -d,

Termgraph (Python Alternative)

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill documentation includes a curl example that sends a request to an external API, but the markdown does not warn users that running it will contact a remote service and may disclose request metadata or queried data. Under the markdown-file criteria, behaviors affecting privacy or external data flow should be disclosed.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The stock-price and response-time sections use curl against external hosts, but the skill description does not warn that these examples contact third-party services. For markdown skills, externally observable actions that may affect privacy or system/network integrity should be called out clearly.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.