ClawHub
Back to skill

Security audit

Works: you projects organized.

Security checks for vulnerabilities and agentic risk

Overview

This project-tracking skill is not malicious, but it needs review because it automatically writes private project records and uses mutable remote install/update paths.

Review before installing. Use this only if you want the agent to automatically create and modify local project records under mind/works and related personal knowledge files. Prefer pinned, reviewed installation/update steps and require explicit confirmation before first-time setup, new project creation, cross-link writes, or replacing the skill from GitHub.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
README.md:62
Finding

Unpinned Third-Party Package Execution Through npx

Content
View full analysis

Vulnerability Details

File Location: README.md, lines 62–66
Vulnerability Type: Supply-chain risk from an unpinned third-party installer
Risk Level: Medium

Vulnerable Code Snippet:

markdown
### Other agents

```bash
npx skills add haah-ing/works-skill
text

### Technical Analysis

The documented installation command invokes the `skills` npm package through `npx` without specifying an audited version or integrity hash. Depending on the local npm configuration and cache state, `npx` may download and execute the package currently resolved by the configured registry.

npm packages may contain executable entry points and lifecycle scripts. Consequently, the command establishes a code-execution boundary with a mutable third-party dependency whose implementation is not included in this repository and could not be audited here. A compromised maintainer account, registry package, transitive dependency, or mutable release could change what the command executes after this skill has been reviewed.

This finding concerns the installation method rather than confirmed malicious behavior by the referenced package.

### Attack Path

1. An attacker compromises the resolved `skills` npm package, one of its executable dependencies, or its publication process.
2. The attacker publishes a malicious version under the package name resolved by `npx`.
3. A user follows the installation instructions in `README.md`.
4. `npx` resolves and downloads the attacker-controlled release because the command does not pin a known-reviewed version.
5. The package executable or an applicable lifecycle script runs with the invoking user's privileges.
6. The malicious code can access resources available to that user and may install modified skill content or perform unrelated local actions.

### Impact Assessment

Successful exploitation could provide arbitrary code execution with the privileges of the user running the command. The
...[truncated 460 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin the installer to an exact, reviewed version rather than resolving the latest release implicitly:
    bash
    npx --yes skills@<reviewed-exact-version> add haah-ing/works-skill
  2. Publish and verify the expected package integrity digest and document the authoritative npm registry and package owner.
  3. Review the pinned package, its executable entry point, lifecycle scripts, and complete transitive dependency tree before recommending it.
  4. Prefer a minimal installer maintained in this repository so users can inspect the exact code before execution.
  5. Recommend running installation as an unprivileged user in a restricted environment without unnecessary secrets.
  6. Add release-management controls such as protected publishing, mandatory multi-factor authentication, provenance attestations, signed releases, and automated dependency auditing.
  7. Explain that users should reassess the installer before changing the pinned version rather than automatically tracking mutable releases.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (11)

Self-Modification

High
Category
Rogue Agent
Confidence
98% confidence
Finding

The skill includes self-modification instructions to fetch a remote SKILL.md from GitHub and replace the current file. This is dangerous because it creates a supply-chain path for unreviewed remote content to alter the agent's future behavior, potentially introducing malicious instructions or weakening safeguards.

Content

Scanner excerpt · SKILL.md (reported line 198)May include surrounding context.

Updating

To update this skill to the latest version, fetch the new SKILL.md from GitHub and replace this file:

text
https://raw.githubusercontent.com/haah-ing/works-skill/main/SKILL.md

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
85% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 48)May include surrounding context.

Claude Code

bash
mkdir -p ~/.claude/skills/works
curl -o ~/.claude/skills/works/SKILL.md https://raw.githubusercontent.com/haah-ing/works-skill/main/SKILL.md

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 48)May include surrounding context.

Claude Code

bash
mkdir -p ~/.claude/skills/works
curl -o ~/.claude/skills/works/SKILL.md https://raw.githubusercontent.com/haah-ing/works-skill/main/SKILL.md

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 49)May include surrounding context.

bash
mkdir -p ~/.claude/skills/works
curl -o ~/.claude/skills/works/SKILL.md https://raw.githubusercontent.com/haah-ing/works-skill/main/SKILL.md

Other agents

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 49)May include surrounding context.

bash
mkdir -p ~/.claude/skills/works
curl -o ~/.claude/skills/works/SKILL.md https://raw.githubusercontent.com/haah-ing/works-skill/main/SKILL.md

Other agents

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The invocation examples are broad and conversational, such as 'What am I working on right now?' and 'That's for the book launch, right? Add it there.' In agents that auto-route skills based on natural-language matching, this can cause the skill to activate during ordinary conversation and write or reorganize persistent project data without sufficiently explicit user intent.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The activation rule is broad enough to trigger on many normal conversations about ongoing activities, causing the agent to treat casual discussion as a project-management event. In context, that can lead to unsolicited persistence, file creation, and cross-linking of personal information without an explicit user request.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill instructs the agent to create directories and maintain project files under the workspace automatically, but it does not present a prominent user-facing warning that filesystem writes will occur. That creates a risk of unexpected local data modification and persistence, especially when the user may only be seeking conversational help.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The instruction 'Don't ask permission — just do it' explicitly removes a consent checkpoint before creating project records. Combined with broad activation, this increases the likelihood of unintended file writes and storage of sensitive personal planning details without the user's informed approval.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
82% confidence
Finding

The skill embeds a specific remote source and update location, which creates a discoverable external dependency and an update path that could be abused if consumers blindly trust it. While enumeration alone is not code execution, it exposes where replacement content is expected to come from and can aid supply-chain targeting.

Content

Scanner excerpt · SKILL.md (reported line 201)May include surrounding context.

To update this skill to the latest version, fetch the new SKILL.md from GitHub and replace this file:

text
https://raw.githubusercontent.com/haah-ing/works-skill/main/SKILL.md

Static analysis

No suspicious patterns detected.