ClawHub
Back to skill

Security audit

shouldislab

Security checks for vulnerabilities and agentic risk

Overview

This skill is a narrowly scoped Pokemon card grading advisor; the main caution is to avoid the README's unpinned remote install command unless you verify what it downloads.

Install from the reviewed packaged SKILL.md or a pinned, verified release rather than piping the current main-branch file straight into your agent's skills directory. Expect the skill to use web search for current Pokemon card prices and grading costs; do not treat its ROI output as financial certainty.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
README.md:35
Finding

Unpinned Remote Skill Installation from a Mutable Branch

Content
View full analysis

Vulnerability Details

File Location: README.md, lines 35-36
Vulnerability Type: Unpinned remote dependency and agent-instruction supply-chain risk
Risk Level: Medium

Vulnerable Code

bash
curl -sL https://raw.githubusercontent.com/KeWang0622/shouldislab/main/SKILL.md \
  -o ~/.claude/skills/shouldislab.md

Technical Analysis

The documented installation command retrieves SKILL.md from the mutable main branch of a personal GitHub repository and writes it directly into the user's active Claude Skills directory. It does not pin a reviewed commit, validate a cryptographic checksum, verify a signature, or provide an intermediate review step.

The retrieved resource is Markdown agent-instruction content rather than a native executable. Nevertheless, placing it in ~/.claude/skills/ establishes it as trusted instructions that may affect later agent sessions. The effective installed content can therefore change after this version of the project has been audited.

The use of HTTPS protects the transfer in transit but does not protect against repository compromise, maintainer-account compromise, or a malicious future modification to the referenced branch. The current bundled SKILL.md was reviewed and does not itself contain malicious instructions.

The GitHub and img.shields.io URLs at README.md:6-7 are promotional links and externally hosted badge images, not executable downloads. They do not constitute the reported vulnerability.

Attack Path

  1. An attacker compromises the repository, its maintainer account, or another mechanism authorized to update the main branch.
  2. The attacker replaces SKILL.md with malicious agent instructions, such as directives to collect sensitive data or misuse available tools.
  3. A user follows the documented curl command.
  4. The command silently follows redirects and directly overwrites ~/.claude/skills/shouldislab.md.
  5. The agent subsequently loa ...[truncated 971 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin the download to a reviewed immutable commit instead of the mutable main branch:
    bash
    curl -fL https://raw.githubusercontent.com/KeWang0622/shouldislab/<full-commit-sha>/SKILL.md \
  -o /tmp/shouldislab.md
  2. Publish the expected SHA-256 digest through a separately protected release channel and verify it before installation:
    bash
    echo "<expected-sha256>  /tmp/shouldislab.md" | sha256sum --check -
  3. Require users to inspect the downloaded file before moving it into the active Skills directory.
  4. Use curl -fL rather than curl -sL so HTTP failures are not silently installed as content.
  5. Install with an explicit final step only after successful verification:
    bash
    install -m 0644 /tmp/shouldislab.md ~/.claude/skills/shouldislab.md
  6. Prefer signed, versioned releases and document how users can verify the release signature and maintainer identity.
  7. Avoid directly overwriting an existing active Skill without making a backup or obtaining user confirmation.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · assets/banner.svg (reported line 19)May include surrounding context.

text
</linearGradient>
  </defs>

  <!-- Background -->
  <rect width="1280" height="640" fill="url(#bg)"/>

  <!-- Subtle grid -->

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · assets/banner.svg (reported line 48)May include surrounding context.

text
<!-- "should" -->
  <text x="640" y="460" text-anchor="middle" font-family="system-ui, -apple-system, 'Segoe UI', Helvetica, Arial, sans-serif" font-size="80" font-weight="300" letter-spacing="2" fill="#ffffff" opacity="0.6">should i</text>

  <!-- "slab" with gold gradient -->
  <text x="640" y="545" text-anchor="middle" font-family="system-ui, -apple-system, 'Segoe UI', Helvetica, Arial, sans-serif" font-size="110" font-weight="900" letter-spacing="-3" fill="url(#gold)">slab?</text>

  <!-- Tagline -->

Static analysis

No suspicious patterns detected.