ClawHub
Back to skill

Security audit

Deepvista Persona Knowledge Worker

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward DeepVista workflow guide, with the main risk being that it installs an unpinned third-party CLI package.

Install only if you trust the DeepVista CLI package source and are comfortable with DeepVista handling cards, notes, recipes, chat content, and accumulated memory. For stronger supply-chain assurance, prefer a pinned and reviewed deepvista-cli version or an installation process with lockfile or hash verification.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:11
Finding

Unpinned Third-Party CLI Dependency

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 11–14
Vulnerability Type: Unpinned third-party dependency
Risk Level: Medium

yaml
install:
  - kind: uv
    package: deepvista-cli
    bins: [deepvista]

Technical Analysis

The skill directs its installation mechanism to retrieve deepvista-cli without specifying an audited version, cryptographic hash, signature, or lockfile. Consequently, the installed artifact depends on the mutable package version resolved by the configured package registry at installation time.

If the publisher account, package registry, release pipeline, or package namespace is compromised, an attacker could distribute a malicious release that is automatically selected during a later installation. The audit found no evidence that deepvista-cli is currently malicious; the vulnerability is the absence of dependency integrity and version controls.

Attack Path

  1. An attacker compromises the deepvista-cli publisher account, release process, or relevant package-registry namespace.
  2. The attacker publishes a malicious package release under the expected package name.
  3. A user installs this skill, and uv resolves the unpinned dependency to the attacker-controlled release.
  4. The malicious package is installed and exposes the expected deepvista binary.
  5. The user or agent invokes deepvista as instructed by the skill.
  6. The malicious package executes with the privileges of the account running the installation or command.

Impact Assessment

Successful exploitation could permit arbitrary code execution under the installing user's privileges. The resulting access could include local files, environment variables, application credentials, and information passed to the CLI, subject to the permissions and sandboxing of the host process. The compromised CLI could also alter command results or disclose cards, notes, recipe inputs, chat content, and memory data handled through it.

No privilege-escalat ...[truncated 146 chars]

Remediation
View remediation

Remediation Suggestions

  • Pin deepvista-cli to a specific version that has been reviewed and tested.
  • Enforce cryptographic integrity using an approved lockfile, package hashes, or verifiable publisher signatures.
  • Configure installation to use an explicit, trusted package index rather than relying on ambient registry configuration.
  • Document the authoritative package publisher and verify package ownership before installation.
  • Establish a controlled update process that reviews dependency changes before advancing the pinned version.
  • Run the CLI with least privilege and isolate it from unrelated secrets and sensitive files where feasible.
  • Incorporate dependency provenance and vulnerability checks into release validation.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.