Security audit

Maiklubi

Security checks for vulnerabilities and agentic risk

Overview

The skill’s myclub.fi purpose is coherent, but it asks users to install and trust a mutable credential-handling npm CLI and includes an unsafe local fallback wrapper outside the skill boundary.

Review this carefully before installing. Only use it if you trust the `maiklubi` npm package and publisher, avoid installing it with elevated privileges, and treat its outputs as sensitive family and club information. Prefer a pinned or audited CLI version and remove stored credentials with `maiklubi config clear` when no longer needed.

A.I.G

Vulnerability Patterns

Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

Location: SKILL.md:12
Finding: Unpinned External npm Package Handles Credentials and Sensitive Account Data
Content: View full analysis
Remediation: View remediation
``` 2. Publish and verify cryptographic integrity hashes or signed release artifacts. 3. Include a lockfile for all transitive dependencies and use a reproducible installation process such as `npm ci`. 4. Clearly document and verify the relationship between the `maiklubi` npm package and the referenced `maiclub` source repository. 5. Audit the actual CLI implementation and its dependency tree because it receives authentication credentials and sensitive family data. 6. Disable unnecessary npm lifecycle scripts during installation where operationally possible: ```bash npm install --ignore-scripts -g maiklubi@ ``` 7. Prefer a bundled, reviewed implementation or a verified local executable over downloading mutable code at installation time. 8. Run the CLI with the minimum required operating-system privileges and never perform the global installation as root. ]]>

T07 · Tool Hijacking and Spoofing

Error

Location: scripts/maiklubi-cli.sh:12
Finding: Wrapper Executes JavaScript from an Untrusted Ancestor Directory
Content: View full analysis
repo root) and a # packaged skill that bundles dist alongside it. SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]:-$0}")" && pwd)" for candidate in \ "$SCRIPT_DIR/../../../dist/index.js" \ "$SCRIPT_DIR/../dist/index.js"; do if [ -f "$candidate" ]; then exec node "$candidate" "$@" fi done ``` ### Technical Analysis When a `maiklubi` executable is not available through `PATH`, the wrapper searches for JavaScript fallback implementations. The first candidate traverses three directory levels above the script: ```bash "$SCRIPT_DIR/../../../dist/index.js" ``` In the supplied layout, `SCRIPT_DIR` is the project's `artifact/scripts` directory. The traversal therefore resolves outside the Skill package boundary. The script verifies only that the candidate is a regular file; it does not verify that the canonical path remains inside a trusted directory, inspect ownership or permissions, or validate the file's integrity. The selected file is passed directly to Node.js: ```bash exec node "$candidate" "$@" ``` Consequently, any party able to create or replace the resolved ancestor `dist/index.js` can cause arbitrary JavaScript to execute under the identity of the user invoking the wrapper. All original CLI arguments are also passed to the substituted implementation. ### Attack Path 1. The legitimate `maiklubi` command is absent from the invoking process's `PATH`. 2. An attacker determines the wrapper's installation path and resolves the `../../../dist/index.js` candidate. 3. The attacker creates a malicious `dist/index.js` at that ancestor location. In the supplied temporary-directory layout, the path can ...[truncated 1293 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The skill explicitly instructs agents to read full notification bodies and event discussion threads, which can contain sensitive personal information about minors, schedules, health, contact details, or internal team assignments, but it provides no privacy guardrails, minimization guidance, or consent boundaries. In this context, the skill is designed for family sports-club data, so unrestricted retrieval and summarization of private club communications increases the risk of over-collection and disclosure to unintended recipients.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.