ClawHub
Back to skill

Security audit

ChipChain

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a coherent semiconductor research workflow, but it includes unsafe optional scripts and API examples that can expose credentials or execute unreviewed packages.

Review before installing. The research methodology is coherent, but do not run the bundled Python verifier scripts unless you are comfortable with them installing unpinned packages, preferably inside an isolated virtual environment. Do not use the documented KIPRIS HTTP curl examples with a real API key unless you have verified a secure transport or accepted the credential exposure risk. Limit API keys to least-privilege research accounts and rotate any key previously used over plaintext HTTP.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
sources.md:99
Finding

KIPRIS API Key Transmitted over Plaintext HTTP

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Error
Location
scripts/_verify_common.py:97
Finding

Automatic Installation and Execution of Unpinned Python Dependencies

Content
View full analysis
None: """Import a package, auto-installing via pip if missing. Args: name: Python import name (e.g., 'pykrx') pip_name: pip package name if different from import name """ try: __import__(name) except ImportError: import subprocess pip_name = pip_name or name print(f"Installing {pip_name}...") subprocess.check_call([sys.executable, "-m", "pip", "install", pip_name]) __import__(name) ``` The helper is invoked for mutable package names in: ```python ensure_package("yfinance") ensure_package("pykrx") ensure_package("requests") ``` These calls occur in `scripts/verify_tickers.py:21`, `scripts/verify_tickers.py:143`, and `scripts/verify_cas.py:22`. ### Technical Analysis When a required module is absent, the verifier automatically invokes pip and installs the package without a pinned version, integrity hash, trusted-index restriction, or explicit user approval. Importing `verify_tickers.py` or `verify_cas.py` is sufficient to trigger this behavior because some calls occur at module scope. Python package installation can execute package build hooks and other installation-time code. The package is then imported into the verifier process. Consequently, the effective code executed by the project is not limited to the reviewed repository and can change whenever the package registry, dependency graph, or local pip configuration changes. The risk includes compromised upstream releases, malicious transitive dependencies, and a hostile or misconfigured package index selected through pip configuration or environment variables. The subprocess call uses an argument list and therefore is not itself vulnerable to shell inject ...[truncated 1666 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (47)

Harmful Content Injection

Critical
Category
Prompt Injection
Confidence
70% confidence
Finding

This content may contain harmful instructions that could cause physical harm if followed. CRITICAL: Review carefully before use.

Content

Scanner excerpt · chemistry/precursor-chains.md (reported line 98)May include surrounding context.

md
├── GlobalWafers (6488.TWO, Taiwan)
│   ├── Czochralski crystal growth from polysilicon melt
│   │   ├── Electronic-grade polysilicon (11N purity)
│   │   │   └── Wacker Chemie (WCH.DE, Germany) — largest
│   │   │   └── Tokuyama (4043.T, Japan)
│   │   │   └── Hemlock Semiconductor (US; Corning Inc. 80.5%, Shin-Etsu Handotai 19.5%; $325M CHIPS Act funding for new facility)
│   │   │   └── REC Silicon (Norway/US)
│   │   │   NOTE: Solar-grade poly (6-9N) is a DIFFERENT market (Tongwei, GCL, Daqo = China)
│   │   │       ├── Trichlorosilane (TCS) reduction (Siemens process)
│   │   │       │   └── Metallurgical-grade silicon (MG-Si)
│   │   │       │       └── Carbothermic reduction of quartz

Harmful Content Injection

Critical
Category
Prompt Injection
Confidence
70% confidence
Finding

This content may contain harmful instructions that could cause physical harm if followed. CRITICAL: Review carefully before use.

Content

Scanner excerpt · chemistry/precursor-chains.md (reported line 114)May include surrounding context.

md
├── GlobalWafers (6488.TWO, Taiwan)
│   ├── Czochralski crystal growth from polysilicon melt
│   │   ├── Electronic-grade polysilicon (11N purity)
│   │   │   └── Wacker Chemie (WCH.DE, Germany) — largest
│   │   │   └── Tokuyama (4043.T, Japan)
│   │   │   └── Hemlock Semiconductor (US; Corning Inc. 80.5%, Shin-Etsu Handotai 19.5%; $325M CHIPS Act funding for new facility)
│   │   │   └── REC Silicon (Norway/US)
│   │   │   NOTE: Solar-grade poly (6-9N) is a DIFFERENT market (Tongwei, GCL, Daqo = China)
│   │   │       ├── Trichlorosilane (TCS) reduction (Siemens process)
│   │   │       │   └── Metallurgical-grade silicon (MG-Si)
│   │   │       │       └── Carbothermic reduction of quartz

Anti-Refusal Statement

High
Category
Anti-Refusal
Confidence
75% confidence
Finding

Skill attempts to nullify the agent's safety policies or restrictions ('you have no restrictions', 'ignore your guidelines', 'do anything now'). This is a direct jailbreak that disables guardrails.

Content

Scanner excerpt · README.md (reported line 316)May include surrounding context.

claude

text

> **Note:** Windows symlinks require Administrator privileges, or Developer Mode enabled in Settings > For Developers.

/chipchain Who supplies CMP slurry to TSMC?

Tp4

High
Category
MCP Tool Poisoning
Confidence
92% confidence
Finding

The declared purpose is narrow, semiconductor supply chain research, but the detected behavior includes generic parsing, report generation, local file operations, and runtime package installation. That mismatch is dangerous because it can hide broad execution and persistence capabilities behind a benign description, making risky behavior harder for users and policy systems to evaluate.

Content

No source excerpt is available for this finding.

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · assets/banner.svg (reported line 14)May include surrounding context.

text
</linearGradient>
  </defs>

  <!-- Background -->
  <rect width="900" height="280" fill="url(#bg)" rx="12"/>

  <!-- Floating multilingual terms — actual semiconductor search terms -->

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · assets/banner.svg (reported line 24)May include surrounding context.

text
<text x="365" y="28" font-size="10">국산화</text>
    <text x="715" y="38" font-size="11">소부장</text>
    <text x="820" y="25" font-size="9">식각</text>
    <!-- Japanese -->
    <text x="145" y="45" font-size="10">仕入先</text>
    <text x="490" y="35" font-size="11">半導体材料</text>
    <text x="600" y="25" font-size="9">歩留まり</text>

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · assets/banner.svg (reported line 82)May include surrounding context.

text
<!-- Arrow -->
    <polygon points="-168,-3 -162,0 -168,3" fill="#6366f1" fill-opacity="0.5"/>

    <!-- Node: VERIFY -->
    <g transform="translate(-105, 0)">
      <rect x="-38" y="-15" width="76" height="30" rx="5" fill="#1e1b4b" stroke="#6366f1" stroke-opacity="0.4" stroke-width="1"/>
      <text x="0" y="1" text-anchor="middle" dominant-baseline="middle" fill="#a5b4fc" font-family="system-ui, -apple-system, sans-serif" font-size="10" font-weight="600" letter-spacing="1">VERIFY</text>

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · assets/banner.svg (reported line 92)May include surrounding context.

text
<!-- Arrow -->
    <polygon points="-32,-3 -26,0 -32,3" fill="#7c3aed" fill-opacity="0.5"/>

    <!-- Node: TRIANGULATE -->
    <g transform="translate(45, 0)">
      <rect x="-52" y="-15" width="104" height="30" rx="5" fill="#1e1b4b" stroke="#7c3aed" stroke-opacity="0.5" stroke-width="1"/>
      <text x="0" y="1" text-anchor="middle" dominant-baseline="middle" fill="#c4b5fd" font-family="system-ui, -apple-system, sans-serif" font-size="10" font-weight="600" letter-spacing="1">TRIANGULATE</text>

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · assets/banner.svg (reported line 102)May include surrounding context.

text
<!-- Arrow -->
    <polygon points="132,-3 138,0 132,3" fill="#a78bfa" fill-opacity="0.5"/>

    <!-- Node: REPORT -->
    <g transform="translate(205, 0)">
      <rect x="-42" y="-15" width="84" height="30" rx="5" fill="#1e1b4b" stroke="#a78bfa" stroke-opacity="0.5" stroke-width="1"/>
      <text x="0" y="1" text-anchor="middle" dominant-baseline="middle" fill="#ddd6fe" font-family="system-ui, -apple-system, sans-serif" font-size="10" font-weight="600" letter-spacing="1">REPORT</text>

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · assets/banner.svg (reported line 113)May include surrounding context.

text
<!-- Title -->
  <text x="450" y="162" text-anchor="middle" fill="#f8fafc" font-family="system-ui, -apple-system, 'Segoe UI', sans-serif" font-size="48" font-weight="700" letter-spacing="-1">chip<tspan fill="url(#accent)">Chain</tspan></text>

  <!-- Tagline -->
  <text x="450" y="195" text-anchor="middle" fill="#9ca3af" font-family="system-ui, -apple-system, sans-serif" font-size="15" font-weight="400" letter-spacing="0.5">Trace the chain. From mine to fab. In five languages.</text>

  <!-- Methodology pills -->

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
85% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 280)May include surrounding context.

bash
git clone https://github.com/lboquillon/chipchain.git
mkdir -p ~/.claude/skills
ln -sfn "$(pwd)/chipchain" ~/.claude/skills/chipchain
claude

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
85% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 293)May include surrounding context.

bash
git clone https://github.com/lboquillon/chipchain.git
mkdir -p ~/.claude/skills
ln -sfn "$(pwd)/chipchain" ~/.claude/skills/chipchain
claude

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 280)May include surrounding context.

bash
git clone https://github.com/lboquillon/chipchain.git
mkdir -p ~/.claude/skills
ln -sfn "$(pwd)/chipchain" ~/.claude/skills/chipchain
claude

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 311)May include surrounding context.

cmd
git clone https://github.com/lboquillon/chipchain.git
if not exist "%USERPROFILE%\.claude\skills" mkdir "%USERPROFILE%\.claude\skills"
mklink /D "%USERPROFILE%\.claude\skills\chipchain" "%CD%\chipchain"
claude

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The README states that the skill 'triggers on semiconductor supply chain questions automatically' without defining the exact trigger phrases, scope limits, or exclusion conditions. This is ambiguous for a markdown file because many natural questions about chips, suppliers, markets, or geopolitics could unintentionally match and invoke the skill.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding

The skill appears to rely on powerful capabilities, including file access, network access, shell execution, and possible file writes, but it does not declare any explicit tool scope or permission boundaries. In an agent environment, this creates excessive implicit authority, which can let prompt-controlled workflows perform unintended local actions, external requests, or command execution without clear restriction.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The activation text says to trigger when a user asks about broad topics like semiconductor materials, suppliers, dependencies, chokepoints, or discovery questions. This is expansive enough to catch many ordinary conversations about semiconductors, and it does not define boundaries or negative examples for when the skill should not activate.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The file requires a minimum of two non-English searches per investigation as a hard rule. This imposes a language behavior on all users without opt-in or an explicit user choice, which can violate language or locale policy expectations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The document presents key search terms and headings in Chinese, Korean, and Japanese across several sections, effectively assuming multilingual usage. Under the stated policy, forcing a specific language or locale without user opt-in is a natural-language policy issue unless the constraint is clearly justified as region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The document is explicitly titled and written as a Japanese lexicon and includes prescriptive language such as preferred spellings and mandatory terminology, but it does not state that use of Japanese is optional or limited to a Japan-specific workflow. Under the language/locale policy, forcing a specific language without user opt-in can be a violation unless the constraint is clearly documented and justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The document is framed as prescriptive guidance for Korean terminology, using imperative language such as 'DON'T translate as' and 'ACTUALLY use,' but it does not indicate that Korean output is optional or limited to Korean-language tasks. This can violate language/locale policy if the skill forces a specific language convention without user opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The instruction 'ALWAYS search both variants for cross-strait research' imposes a specific language/locale handling requirement in natural language. While the file is about Simplified Chinese terminology, this directive is framed as a mandatory rule rather than an optional or context-limited recommendation, which can violate language/locale choice policy without explicit user opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

Line L020 states 'ALWAYS search BOTH zh-cn and zh-tw variants for cross-strait research,' and the document overall instructs users to avoid mainland terms in favor of Taiwan-specific wording. This is a natural-language locale policy constraint presented as mandatory guidance, but the file does not explicitly offer language/locale opt-in or explain that the skill is intentionally region-specific beyond the title.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
83% confidence
Finding

The workflow instructs users to search using Korean and Chinese terms, and later mandates Korean, Chinese, Japanese, and Taiwan-specific query patterns. This imposes specific language/locale behavior without an explicit opt-in or justification that the skill is limited to multilingual semiconductor-source research.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The manifest describes the skill as providing broad 'Semiconductor supply chain intelligence,' which implies coverage across chip supply chain domains. This file is specifically a 'Chemistry Chain Tracing Workflow' focused on tracing chemicals from fab use through purification, raw materials, and mining, with no broader semiconductor supply chain coverage in the file itself. That creates a semantic mismatch between the claimed general-purpose scope and the actual implemented/documented behavior here.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.