ClawHub
Back to skill

Security audit

Deepvista Notes

Security checks for vulnerabilities and agentic risk

Overview

The skill is a disclosed DeepVista note-management helper with expected read/write/delete note actions and no evidence of hidden or destructive behavior beyond user-confirmed note operations.

Install only if you intend to use DeepVista for note storage. Confirm create, update, and delete actions carefully, and avoid importing private local files or URL content unless you want the exact content stored in DeepVista. The main residual risk is the unpinned CLI dependency, so prefer reviewed or pinned installs when available.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:14
Finding

Unpinned Third-Party CLI Dependency

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 14–21
Vulnerability Type: Supply-chain exposure through an unpinned third-party dependency
Risk Level: Medium

Vulnerable Code

yaml
requires:
  bins:
    - deepvista
  skills:
    - deepvista-shared
install:
  - kind: uv
    package: deepvista-cli
    bins: [deepvista]

Technical Analysis

The skill declares installation of the third-party deepvista-cli package through uv without specifying an exact version, integrity hash, signature, lockfile, or trusted package source. Consequently, the package resolved during a future installation may differ from the version originally reviewed.

This is a supply-chain weakness rather than evidence that the current package is malicious. If the package registry account, distribution package, or transitive dependency is compromised, installation or subsequent CLI invocation could execute attacker-controlled code with the permissions of the agent process.

Attack Path

  1. An attacker compromises the deepvista-cli package, its publishing account, its registry namespace, or a transitive dependency.
  2. The attacker publishes a malicious release that remains compatible with the unversioned package requirement.
  3. The skill installation process resolves and installs that release through uv.
  4. Malicious package installation hooks or runtime code execute when the package is installed or the deepvista command is invoked.
  5. The payload accesses resources available to the agent process or performs unauthorized actions within that process's security context.

Impact Assessment

Successful exploitation could permit arbitrary code execution with the privileges of the account running the agent or installation process. Depending on that environment, the affected scope may include readable local files, environment variables, service credentials, DeepVista authentication material, and netwo ...[truncated 322 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin deepvista-cli to an exact, reviewed version rather than allowing mutable version resolution.
  2. Verify package artifacts with cryptographic hashes or trusted publisher signatures.
  3. Use and commit a lockfile that records all transitive dependency versions and integrity information.
  4. Configure uv to use an explicitly trusted package registry and prevent dependency-confusion fallback to unintended sources.
  5. Review dependency changes before updating the pinned version, and add automated vulnerability and provenance scanning.
  6. Install and execute the CLI under least privilege, with access limited to only the files, credentials, and network destinations required for note management.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep