ClawHub
Back to skill

Security audit

Find Skill HEQI

Security checks for vulnerabilities and agentic risk

Overview

This skill is a legitimate skill-discovery helper, but it encourages mutable external package execution and global skill installation with confirmations disabled.

Before installing, confirm you actually want an external skill rather than normal assistant help. Prefer pinned, trusted versions of the CLI and skills, inspect the source and publisher, avoid `-g -y` unless you intentionally want a global persistent install, and run third-party installers in a restricted environment when possible.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:28
Finding

Unpinned Package Execution and Unverified Global Skill Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 28–31 and 84–88
Vulnerability Type: Supply-chain exposure through unpinned dependencies and unverified external skills
Risk Level: Medium

Vulnerable Code

bash
npx skills find [query]
npx skills add <package>
npx skills check
npx skills update
bash
npx skills add <owner/repo@skill> -g -y

Technical Analysis

The skill directs the agent to execute the unversioned skills npm package through npx. When the package is unavailable locally, npx may download and execute the package version currently resolved from the configured npm registry. Because the command does not pin an audited version or verify package integrity, the executable behavior can change after this skill has been reviewed.

The installation workflow also allows skills from GitHub or other external sources. It does not require repository allowlisting, immutable commit pinning, signature or checksum validation, or inspection of downloaded files before installation. The documented -g -y flags expand the installation to user-level global scope and suppress confirmation prompts.

This creates a supply-chain trust boundary in which a compromised package, compromised repository, unsafe external source, or deceptive package identity could introduce attacker-controlled code or agent instructions.

Attack Path

  1. An attacker compromises the resolved skills npm package, an upstream skill repository, or another accepted installation source.
  2. A user asks the agent to discover or install a relevant skill.
  3. The agent executes the documented unpinned npx skills command, causing the currently resolved package to run with the invoking user's privileges.
  4. The attacker-controlled package or external skill executes during installation or places malicious content in the skill installation directory.
  5. Use of -y prevents an interactive confirmation ...[truncated 945 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin the CLI to an exact, audited version, for example:

    bash
    npx --yes skills@<exact-version> find <query>

  2. Prefer a lockfile-backed local dependency installed through a controlled build process instead of downloading executable packages at runtime.

  3. Restrict skill installation to approved repositories and verified publishers.

  4. Pin external skills to immutable commit hashes or cryptographically verified releases.

  5. Verify checksums or signatures where supported.

  6. Inspect each skill's instructions, scripts, dependencies, lifecycle hooks, and external URLs before installation.

  7. Remove -y from the default workflow so users can review the resolved source, version, and requested changes.

  8. Avoid -g by default. Use project-local or otherwise isolated installation unless global scope is explicitly necessary and approved.

  9. Run third-party installation tooling in a sandbox with restricted filesystem, network, environment-variable, and credential access.

  10. Display the exact package identity, repository URL, immutable revision, publisher, and installation scope before execution.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (17)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The description says the skill should activate for broad prompts like 'how do I do X' and other generic capability questions, which overlaps heavily with ordinary assistant use. Over-broad triggering can cause the agent to steer users toward external package discovery and installation even when not necessary, increasing exposure to untrusted tools and remote content.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The usage rules contain ambiguous triggers such as asking 'can you do X' or expressing interest in extending capabilities, but they do not define clear boundaries for when the skill should stay inactive. This can lead to unnecessary invocation of a workflow that recommends executing external package-management commands, making social-engineering or accidental unsafe installs more likely.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The skill repeatedly instructs use of npx skills without pinning a specific package version. Because npx resolves and may fetch the latest package at execution time, this creates a supply-chain risk where a compromised or maliciously updated package could be executed with the user's privileges.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

This command reference uses npx skills without a version pin, allowing runtime resolution of whatever package version is current. If the package is replaced, hijacked, or publishes a malicious update, users may execute untrusted code when following the skill instructions.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The unpinned npx skills command leaves the executed code dependent on mutable registry state. That creates a realistic package substitution or malicious update path, especially because the skill encourages discovery and installation of additional remote content.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

Referencing npx skills without a fixed version permits execution of changing code from the package registry. In a skill that is explicitly about installing more skills from external sources, this compounds supply-chain exposure and increases the chance of user compromise.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The command example invokes a network-resolved CLI with no version constraint. An attacker controlling the package, dependency chain, or distribution channel could cause arbitrary code execution when the user follows these instructions.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

This search command uses an unpinned npx package, so even a seemingly harmless find operation can execute untrusted code before performing the search. Because users are told to run it directly, the skill normalizes execution of mutable remote code.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The sample command at this line demonstrates unpinned execution of the skills package. If the package or one of its dependencies becomes malicious, users could execute attacker-controlled code simply by following the documented example.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

This example repeats the same unpinned package execution pattern. The risk is amplified because the skill frames these commands as normal workflow steps, lowering user suspicion around running arbitrary package-manager-delivered code.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

An unpinned npx skills example appears here as well, preserving a supply-chain execution path. Since the skill helps users discover and add more remote skills, compromise of the CLI could cascade into broader system or workspace compromise.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The install command shown here uses npx skills without version pinning, so the installer itself is mutable. This is particularly dangerous because the command then installs additional external content, increasing the blast radius of a compromised CLI.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The global install flow still depends on an unpinned npx package. A compromised latest package could run code and then make persistent changes by installing skills globally, making recovery harder.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill recommends npx skills add <owner/repo@skill> -g -y, which performs a global install and suppresses confirmation prompts. This encourages persistent system modification and removes an important user review step, making accidental or malicious installation of unsafe skills significantly easier.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

This line continues the pattern of invoking registry-fetched code without a fixed version. In the context of package installation and updates, that creates a direct supply-chain path to arbitrary code execution and persistent environment modification.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
94% confidence
Finding

Even this fallback suggestion uses an unpinned npx package, exposing users to the same supply-chain execution risk. While initialization is less dangerous than global install, it still runs mutable remote code on the user's system.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
94% confidence
Finding

The final npx skills reference is also unpinned, so it inherits the same risk of arbitrary code execution through package substitution or malicious updates. Repetition throughout the skill increases the likelihood that users will execute the unsafe pattern.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.