T08 · Insecure Dependencies
Warning
- Location
PUBLISHING.md:86- Finding
Unpinned ClawHub Package Execution in Publishing Instructions
- Content
View full analysis
- Remediation
View remediation
Security audit
Cyber Fantasy UI Skill
Security checks for vulnerabilities and agentic risk
Overview
This skill is a disclosed UI design reference, with only minor maintainer-documentation risks rather than hidden or unsafe runtime behavior.
Safe to install as a UI styling reference. Before reusing the publishing commands, prefer a pinned ClawHub CLI version, and treat rsync --delete as destructive by checking source and destination paths first.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (15)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The documented
rsync -av --delete ...command will delete files in the destination that are not present in the source, but the instructions do not explicitly warn about that destructive behavior. In this context, the destination is a user workspace path, so a copy-paste execution mistake or path typo could remove existing skill data or other local content.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 89% confidence
- Finding
The publishing instructions invoke
npx clawhubwithout pinning an exact package version, which means the command may fetch and execute whatever version is current at runtime. In a publishing workflow, this increases supply-chain risk because a compromised or breaking upstream release could execute code on the publisher's machine or alter the publish behavior unexpectedly.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 89% confidence
- Finding
Using
npx clawhub publish . ...without an exact version causes dynamic retrieval and execution of the latest package version available to the environment. Because this command is used at release time and operates on the repository contents, an unexpected or malicious upstream package update could affect published artifacts or run arbitrary code during the release process.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 86% confidence
- Finding
Even the help invocation
npx clawhub publish --helpcan causenpxto download and execute an unpinned package version. While this particular command is lower impact than publishing, it still expands the attack surface by encouraging execution of a non-reproducible external package.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md - Design a cyber-fantasy dashboard for a habit tracker using React and Tailwind. - Restyle this page into a dark neon glassmorphism UI with purple glow and liquid progress bars. - Build a gamified profile screen with merit points, cultivation levels, and mystical status cards. - Create an immersive mobile event page with dark glass panels and restrained sci-fi motion. - Turn this plain admin interface into a game-like dashboard without changing its data model. ## Why This Skill
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 79% confidence
- Finding
该文件整体以简体中文编写，用作技能说明文档，但未在文档正文中说明语言选择机制、适用区域限制，或提示用户可切换到其他语言版本。虽然顶部链接包含英文 README，但当前文档本身没有明确的语言/地区选择说明，存在语言/区域策略上的自然语言约束风险。
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
全局安装
bash mkdir -p ~/.openclaw/skills/cyber_fantasy_ui rsync -av ./ ~/.openclaw/skills/cyber_fantasy_ui/
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md - do not keep `body { overflow: hidden; }` unless the product is intentionally a full-screen experience - do not disable text selection globally unless the interface truly needs it - do not add expensive blur and animation effects to large scrolling lists without checking performance ## Visual Language
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The document declares
lang="en", which sets the page language to English even though the content includes mixed Chinese and English text. Under the policy criteria, forcing a specific language or locale without user opt-in or justification is a natural-language policy concern.- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
The stylesheet sets the body font-family to "Noto Sans SC", which is a Simplified Chinese-oriented font choice applied globally. For this file type, natural-language policy violations include forcing a specific language or locale without user opt-in, and there is no visible indication here of user choice or region-specific justification.
- Content
Static analysis
No suspicious patterns detected.