ClawHub
Back to skill

Security audit

RenderMark

Security checks for vulnerabilities and agentic risk

Overview

RenderMark is a legitimate-looking document publishing skill, but it asks users to run an unpinned remote MCP package and handles publishing, sharing, and credentials with limited safety guidance.

Review before installing. Use a pinned, vetted version of the MCP server rather than `@latest`; protect `~/.rendermark/config.json` as a secrets file; avoid publishing or syncing sensitive documents unless you intend to send them to RenderMark, Google, Browserless, GitHub, or email recipients; and require explicit confirmation before share, update, sync, or delete actions.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
references/setup-guide.md:3
Finding

Unpinned npm Package Is Downloaded and Executed Through npx

Content
View full analysis

Vulnerability Details

File Location: references/setup-guide.md:3-7
Additional Locations: references/setup-guide.md:61-64, SKILL.md:167-169, SKILL.md:179-181
Vulnerability Type: Unpinned third-party dependency execution
Risk Level: Medium

Vulnerable Code

markdown
## Installation

npx -y @rendermark/mcp-server@latest

text

The same unsafe installation pattern is repeated in the troubleshooting instructions:

markdown
### MCP connection issues
- Verify the server is running: check Claude Settings > Extensions
- Try `npx -y @rendermark/mcp-server@latest` to ensure latest version
- Check that Node.js 18+ and npx are available

SKILL.md similarly instructs users to run:

markdown
Install via `npx -y @rendermark/mcp-server@latest`.

Technical Analysis

The Skill directs users to download and execute @rendermark/mcp-server using the mutable latest npm tag. Consequently, the code executed during installation can change after this Skill has been reviewed. The -y option also suppresses the normal installation confirmation.

Executing an npm package can run its command-line entry point and package lifecycle behavior with the permissions of the invoking user. If the package publication account, npm package, or a transitive dependency is compromised, a malicious future release selected by @latest could execute arbitrary code locally.

The external MCP server is required for the declared RenderMark functionality, but selecting a mutable release is not required. Therefore, this behavior exceeds the minimum supply-chain risk necessary to provide the Skill's functionality. The artifact itself contains no evidence that the current package is malicious; the vulnerability is the absence of version and integrity controls.

Attack Path

  1. An attacker compromises the npm maintainer account, package publication pipeline, or a dependency incorporated in ...[truncated 1390 chars]
Remediation
View remediation

Remediation Suggestions

  1. Replace @latest with an exact version that has been reviewed and tested, for example:

    bash
    npx -y @rendermark/mcp-server@0.1.10

  2. Keep the pinned version synchronized with the version declared in SKILL.md metadata. Upgrade it only through an explicit review process.

  3. Prefer a package installation workflow that uses a committed lockfile and npm integrity metadata rather than retrieving a mutable release on every invocation.

  4. Remove -y where unattended installation is unnecessary so users can review the package and version before execution.

  5. Verify package provenance, published checksums, maintainer changes, lifecycle scripts, and transitive dependency changes before updating the pin.

  6. Run the MCP server with least privilege. Restrict access to unrelated files, environment variables, and credentials where sandboxing or containerization is available.

  7. Store credential files with restrictive filesystem permissions and avoid exposing unrelated secrets to the MCP server process.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (19)

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md
---
name: rendermark
description: Professional markdown rendering, export, and publishing via MCP. Use when user asks to "render markdown", "export to PDF", "convert to DOCX", "create a document", "publish a document", "share a link", "make a slide deck", "diff two markdown files", "export to HTML", "create a shareable document", "sync docs from GitHub", or "generate an image of this markdown". Do NOT use for simple markdown editing, code generation, or general writing that doesn't need styled output.
license: MIT-0
compatibility: Requires Node.js 18+ and npx. PDF/image export requires Chrome or Browserless API. Google Docs requires OAuth setup.
metadata:

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The publishing and sharing workflow sends document contents to external services (rendermark.app, Google Docs, email-based sharing) but does not instruct the agent to warn or confirm with the user before transmitting potentially sensitive content. In a document-handling skill, this omission is materially risky because users may assume operations are local when they are not.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 174)May include surrounding context.

md
Result: README imported from GitHub, published at rendermark.app with relative images resolved.

### Example 6: Create a meeting notes document

User says: "Turn these notes into a proper meeting notes document and share it with the team"

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The setup instruction uses npx -y @rendermark/mcp-server@latest, which pulls and executes the newest package version at runtime without a fixed version. This creates a supply-chain risk: a compromised publisher account, malicious release, or breaking update could cause users to run unintended code.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The troubleshooting guidance again tells users to run npx -y @rendermark/mcp-server@latest, which executes whatever version is currently published. Repeating this pattern increases the chance that users will bypass version review and run an untrusted or newly compromised release.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
96% confidence
Finding

The setup guide instructs users to execute an unpinned package via npx using @latest, which causes code to be fetched and run at install time from the registry without version stability. If the package is compromised, a malicious version is published, or the dependency chain is poisoned, users may execute attacker-controlled code on their workstation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The guide tells users to store live API keys and Google OAuth client secrets in a local config file but provides no warning about file permissions, secret handling, or the risks of committing the file to source control. On shared systems or misconfigured environments, these credentials could be read by other users or leaked through backups, logs, or repositories.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
92% confidence
Finding

The command runs the MCP package without pinning to an exact version, so users may authenticate against newly published code that has not been reviewed. Because this flow is used for Google auth, compromise could expose OAuth tokens or allow execution of malicious install/runtime logic.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
92% confidence
Finding

Re-authentication is performed through an unpinned npx invocation, creating a supply-chain risk during a sensitive OAuth flow. An attacker controlling a published update or dependency could capture credentials, tokens, or execute arbitrary code.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The troubleshooting step again tells users to run the latest package directly from the registry, which encourages repeated execution of mutable remote code. In a support context, users are likely to follow such instructions quickly, increasing exposure to supply-chain compromise.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The publishing tools send markdown content to external services such as rendermark.app and Google Docs, but the reference does not include an explicit privacy or data-sharing warning. Users may unknowingly send sensitive or proprietary content to third parties, creating confidentiality and compliance risks.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

Share, live preview, document management, and GitHub sync operations can expose content to other people or external platforms, yet the tool reference does not clearly warn about that exposure. In an agent setting, this omission is dangerous because users may interpret these as local formatting actions rather than networked sharing or synchronization.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/tools-reference.md (reported line 91)May include surrounding context.

md
- `title` (string, required): Document title

### share_live_preview
Create a temporary shareable preview URL.

**Parameters:**
- `markdown` (string, required): Markdown content

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The documented capability extends far beyond markdown rendering/export into full remote document lifecycle operations such as listing, updating, sharing, and deleting hosted documents. This expands the skill’s authority and creates risk of unintended data exposure, modification, or destructive actions if the agent invokes these tools without very clear user intent and consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
83% confidence
Finding

The GitHub sync feature implies transmitting repository path, owner/repo metadata, and fetched content through an external service, but the skill does not warn the user about that data flow. This is lower impact than direct document sharing, but still a real privacy and confidentiality concern, especially for private repositories or sensitive docs.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
81% confidence
Finding

The browser-based authentication and Google Docs publishing instructions do not warn users that account data, tokens, and document content may be transmitted to third-party services such as RenderMark, Google, or Browserless. While common for these integrations, omission of a disclosure reduces informed consent and can lead to inappropriate use with sensitive documents.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

The setup flow launches a browser and stores credentials locally in ~/.rendermark/config.json, but this sensitivity is not prominently disclosed in the skill description. Hidden auth side effects can surprise users and increase the chance of credential mishandling on shared systems or when users do not expect persistent local storage.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.