ThumbGate

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:21 AM UTC
• Version: 1.5.0

Overview

The skill has a coherent agent-guard purpose, but it uses an unpinned npm initializer to install persistent pre-tool hooks across agents without enough scoping or rollback detail.

Review the npm package and its hook changes before installing. Prefer a pinned, audited version, run it with least privilege, confirm exactly which agent configs it modifies, and make sure you have clear disable/uninstall steps before allowing it to intercept tool calls.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:4

Finding

Unpinned npm Package Execution with Privileged Agent-Hook Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 4 and 19-23
Vulnerability Type: Unpinned third-party package execution
Risk Level: High

Vulnerable Code Snippet:

yaml

metadata: {"clawdbot":{"emoji":"🧰","requires":{"bins":["thumbgate"]},"install":[{"id":"npm","kind":"npm","module":"thumbgate","bins":["thumbgate"],"label":"Install ThumbGate (npm)"}]}}

markdown

## Quick Start

```bash
npx thumbgate init

Bootstraps .thumbgate/ and wires PreToolUse hooks into your agent. Works out-of-the-box with Claude Code, Cursor, Codex, Gemini CLI, Amp, OpenCode, and any MCP-compatible agent.

text

### Technical Analysis

The skill directs users to execute `npx thumbgate init` without specifying an exact package version or validating package integrity. By default, `npx` can retrieve the current package release from the configured npm registry and execute its lifecycle and command code with the invoking user's privileges.

Because neither an exact audited version nor an integrity hash is supplied, the effective executable payload can change after this skill has been reviewed. A compromised maintainer account, malicious package release, registry compromise, or other supply-chain incident could therefore cause arbitrary code to run when the initialization command is invoked.

The initialization operation is especially sensitive because it is explicitly described as installing `PreToolUse` hooks into supported agents. Such hooks occupy a privileged interception point where they may inspect, block, or alter subsequent tool-call behavior. The package implementation and lockfile are absent from the audited project, so its installation behavior, configuration changes, and data handling cannot be independently verified here.

### Attack Path

1. An attacker compromises the npm package, its publisher account, or the relevant package-distribution channel.
2. The attacker publishes a malicious release un
...[truncated 1285 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the dependency to an exact, reviewed version, such as thumbgate@X.Y.Z, rather than resolving the latest release dynamically.
2. Commit an appropriate lockfile and verify package integrity through npm integrity metadata or an independently maintained checksum.
3. Avoid direct execution of remotely resolved packages. Install the reviewed artifact first, verify it, and invoke the locally pinned binary afterward.
4. Disable or carefully review npm lifecycle scripts during installation where operationally possible.
5. Document every file and agent configuration modified by init, including the exact hook definitions that will be installed.
6. Require explicit user confirmation before changing agent configuration or enabling PreToolUse hooks.
7. Provide documented inspection, disablement, uninstall, and rollback procedures for all installed hooks and generated files.
8. Run initialization with the least privileges necessary and avoid using an administrator or root account.
9. Vendor or include the security-relevant hook implementation in the reviewed project so its behavior and data flows can be audited.
10. Clearly disclose whether intercepted tool-call data, feedback, lessons, or audit records leave the local system, and require explicit consent before any remote transmission.

SkillSpector

Vulnerability Patterns

• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 70% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 29)May include surrounding context.

Core Commands

bash

thumbgate capture "Never run --force push to main"   # create a rule
thumbgate gates list                                  # see active gates
thumbgate feedback down "agent ignored file paths"    # capture a thumbs-down
thumbgate lessons search "DROP TABLE"                 # recall prior lessons

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 70% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 46)May include surrounding context.

md

## When to Use This Skill

- The agent keeps hallucinating the same wrong import, wrong file path, or wrong command.
- You want destructive operations (`DROP TABLE`, `git push --force`, etc.) blocked at the tool-call layer, not the prompt layer.
- You need an audit trail of *what the agent tried to do and was prevented from doing* for compliance / review.
- You want DPO-ready preference pairs exported from your real feedback for fine-tuning.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence

Finding

The skill instructs users to run npx thumbgate without pinning a specific package version. This allows execution of whatever version is currently published to the registry, which creates a supply-chain risk if a malicious or compromised release is published later. In a skill that bootstraps hooks into multiple agents, that risk is more concerning because the installed package may gain broad influence over tool-call behavior.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.