ClawHub
Back to skill

Security audit

Shader Helper

Security checks for vulnerabilities and agentic risk

Overview

This shader helper is coherent and purpose-aligned, with ordinary demo-template risks around browser dependencies and dev-server exposure.

Installers should be comfortable with a shader-focused helper that may suggest running browser demos. If you use the R3F template, review and pin npm dependencies, prefer localhost-only Vite serving unless LAN access is needed, and avoid running CDN-backed demos in sensitive browser sessions.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (14)

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The declared purpose centers on shader authoring and troubleshooting across GLSL/WebGL/Three.js/R3F contexts. The actual code only configures Vite's development server (host: true, port: 5173). This is general build/dev-environment setup, not shader creation, adaptation, debugging, or runtime wiring. While such config could support a demo project, it is not a supporting implementation detail of shader behavior in this isolated chunk; its primary purpose is unrelated tooling configuration. Therefore the description does not accurately represent this code chunk.

Content

No source excerpt is available for this finding.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 142)May include surrounding context.

md
- `assets/r3f-demo/package.json`

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The skill enables implicit invocation without any stated trigger constraints, exclusions, or narrowing conditions. That increases the chance the agent will auto-select this skill in broader contexts than intended, which can expose users to unintended code generation, shader-related browser demo output, or prompt-scope interference from tool instructions when the user did not explicitly request this capability.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
89% confidence
Finding

The references list includes references/effect-starters-zh.md, which implies a Chinese-language resource is part of the skill's expected materials. The file does not indicate that this resource is optional, provide an alternative language choice, or justify the locale-specific reference, which can conflict with language/locale policy expectations.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · assets/r3f-demo/package.json (reported line 12)May include surrounding context.

json
"preview": "vite preview"
  },
  "dependencies": {
    "@react-three/fiber": "^8.18.0",
    "react": "^18.3.1",
    "react-dom": "^18.3.1"
  },

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · assets/r3f-demo/package.json (reported line 13)May include surrounding context.

json
},
  "dependencies": {
    "@react-three/fiber": "^8.18.0",
    "react": "^18.3.1",
    "react-dom": "^18.3.1"
  },
  "devDependencies": {

Unverifiable Dependency: react has 2 known advisory(ies) (CVE-2013-7035 (Cross-Site Scripting in react); GHSA-hg79-j56m-fxgv (Cross-Site Scripting in react)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · assets/r3f-demo/package.json (reported line 14)May include surrounding context.

json
"dependencies": {
    "@react-three/fiber": "^8.18.0",
    "react": "^18.3.1",
    "react-dom": "^18.3.1"
  },
  "devDependencies": {
    "vite": "^5.4.0"

Unverifiable Dependency: react-dom has 1 known advisory(ies) (CVE-2018-6341 (Cross-Site Scripting in react-dom)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · assets/r3f-demo/package.json (reported line 17)May include surrounding context.

json
"react-dom": "^18.3.1"
  },
  "devDependencies": {
    "vite": "^5.4.0"
  }
}

Unverifiable Dependency: vite has 16 known advisory(ies) (CVE-2023-34092 (Vite Server Options (server.fs.deny) can be bypassed using double forward-slash ); CVE-2025-32395 (Vite has an `server.fs.deny` bypass with an invalid `request-target`); CVE-2025-31125 (Vite has a `server.fs.deny` bypassed for `inline` and `raw` with `?import` query) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
74% confidence
Finding

Vite has multiple recent server.fs.deny bypass advisories, and this manifest uses a broad version range (^5.4.0) without an exact pinned resolution, so it is not possible to verify whether the installed dev server includes fixes. In the context of an R3F demo, the exposure is somewhat reduced because vite is a development dependency, but if developers run preview/dev servers on shared networks or CI environments, a vulnerable resolved version could enable unintended file access or related dev-server compromise.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
89% confidence
Finding

The page imports executable JavaScript directly from a third-party CDN at runtime, which creates a supply-chain trust dependency outside the application's control. If the CDN content is tampered with, the package is replaced, or the dependency changes unexpectedly, arbitrary script would execute in the user's browser with the same privileges as the page.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

This HTML file declares lang="en", which hard-codes an English locale. Under the policy criteria, forcing a specific language without user opt-in or a documented justification is a natural-language policy issue.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The file presents user trigger phrases solely in Chinese, which can impose a language-specific constraint without user opt-in. Under the policy rule, language restrictions should either offer a choice or be clearly documented as intentionally region-specific.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.