ClawHub
Back to skill

Security audit

envoic

Security checks for vulnerabilities and agentic risk

Overview

This skill has a coherent cleanup purpose, but its examples include unsafe unverified installation and broad destructive cleanup commands that users should review carefully.

Install only after you are comfortable with envoic's package source and version. Prefer pinned versions, avoid curl-to-shell installation, start with narrow project paths, run dry-run scans first, and do not allow non-dry-run cleanup or --yes deletion unless you have reviewed exactly what will be removed.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T03 · Remote Payload Retrieval and Execution

Error
Location
references/troubleshooting.md:5
Finding

Unverified Remote Installer Is Piped Directly into a Shell

Content
View full analysis

Vulnerability Details

File Location: references/troubleshooting.md:5
Vulnerability Type: Remote payload retrieval and immediate execution
Risk Level: High

Vulnerable Code:

bash
curl -LsSf https://astral.sh/uv/install.sh | sh

Technical Analysis

The troubleshooting guide instructs the user or agent to retrieve a mutable script from an external URL and pipe the response directly into sh. The downloaded content is executed without being saved for inspection, pinned to a reviewed version, or validated using a checksum or cryptographic signature.

HTTPS protects the connection in transit but does not ensure that the current server response is the same content that was reviewed when the Skill was published. A compromise of the hosting service, its deployment pipeline, domain, or TLS trust chain could turn this installation command into arbitrary code execution.

Installing uv may support the Skill's workflow, but executing an unverified remote response is not the minimum privilege necessary to install that dependency.

Attack Path

  1. The agent attempts to use uvx and discovers that it is unavailable.
  2. The agent follows the troubleshooting guide and runs the documented command.
  3. curl retrieves the current content from the external endpoint.
  4. The response is passed directly to sh without integrity verification or review.
  5. If the endpoint or delivery chain is compromised, attacker-controlled shell commands execute under the invoking user's identity.

Impact Assessment

A malicious installer would execute with all privileges available to the invoking user. It could read or modify accessible workspace files, source code, shell configuration, credentials, and user-level application data. It could also install additional software or establish persistence where the user's permissions allow it.

The command does not explicitly invoke sudo, so administrative privileges are no ...[truncated 122 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove the direct curl | sh pipeline.
  2. Prefer an official operating-system package manager or other trusted installation channel.
  3. If a standalone installer is necessary:
    • Pin the installer or release to a reviewed version.
    • Download it to a local file rather than piping it into a shell.
    • Verify a publisher-provided cryptographic signature or checksum obtained through an independent trusted channel.
    • Inspect the downloaded script before execution.
    • Execute it without elevated privileges unless elevation is demonstrably required.
  4. Make installation an explicit user-approved step rather than allowing an agent to install tooling automatically.
  5. Retain the documented pip fallback only after applying the dependency-pinning and verification controls described in the separate dependency finding.

T08 · Insecure Dependencies

Warning
Location
SKILL.md:28
Finding

Unpinned Third-Party Packages Are Retrieved and Executed

Content
View full analysis

Vulnerability Details

File Locations: SKILL.md:28-34, references/commands.md:4-39, and references/troubleshooting.md:6-12
Vulnerability Type: Unpinned dependency retrieval and execution
Risk Level: Medium

Vulnerable Code from SKILL.md:

bash
uvx envoic scan .
uvx envoic manage . --dry-run
npx envoic scan . --deep
text
If `uvx` is unavailable, install Python package with `pip install envoic`.
If `npx` is unavailable, install JS package with `npm install -g envoic`.

Vulnerable Code from references/commands.md:

bash
uvx envoic scan .
uvx envoic scan ~/projects --deep
uvx envoic scan . --json
uvx envoic scan . --stale-days 60
uvx envoic scan . --no-artifacts
npx envoic scan ~/projects --deep
bash
uvx envoic manage ~/projects --deep
uvx envoic manage . --stale-only
uvx envoic manage . --dry-run
npx envoic manage ~/projects --deep
bash
uvx envoic list ~/projects
npx envoic list ~/projects
bash
uvx envoic info ~/projects/myapp/.venv
npx envoic info ~/projects/webapp/node_modules
bash
uvx envoic clean ~/projects --stale-days 90
uvx envoic clean ~/projects --dry-run
uvx envoic clean ~/projects --yes

Vulnerable Code from references/troubleshooting.md:

bash
pip install envoic
bash
npm install -g envoic

Technical Analysis

The Skill invokes or installs envoic by package name without specifying a reviewed version, package hash, trusted index configuration, or publisher-verification procedure. Both uvx and npx may retrieve and execute package code as part of ordinary command invocation. The fallback installation commands similarly select the latest version resolved by the configured package registry.

This creates a supply-chain trust boundary that is not adequately constrained. A future compromised release, registry account compromise, dependency confus ...[truncated 2099 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin both Python and npm invocations to explicitly reviewed versions rather than resolving the latest release.
  2. For Python distributions, use a trusted index explicitly and require publisher-provided hashes where the selected workflow supports them.
  3. For npm distributions, pin an exact version and verify package provenance or registry integrity metadata before use.
  4. Confirm and document that the PyPI and npm packages are both official artifacts maintained by the declared project publisher.
  5. Review and pin transitive dependencies through lockfiles or reproducible package metadata.
  6. Avoid global installation when an isolated, version-pinned execution environment is sufficient.
  7. Disable package lifecycle scripts where feasible, or review them before allowing installation.
  8. Require explicit user approval before downloading or executing a package that is not already installed.
  9. Restrict initial scans to the narrowest necessary project root rather than broad paths such as ~/projects.
  10. Preserve the existing scan-first, dry-run, and explicit-confirmation requirements for all destructive operations.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (30)

Rp1

Medium
Category
MCP Rug Pull
Confidence
91% confidence
Finding

The command uvx envoic scan . invokes a package without an explicit version pin. Although uvx is commonly used for ephemeral execution, leaving the version unspecified can still cause unreviewed package updates or a compromised release to be executed unexpectedly.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
91% confidence
Finding

uvx envoic manage . --dry-run is unpinned and references a tool that can perform environment management and, outside dry-run mode, potentially destructive operations. Even though this example uses --dry-run, the executed package code itself is still untrusted if fetched at an unspecified version.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The skill instructs users to run npx envoic without pinning a version, which allows execution of whatever package version is currently resolved from the registry. If the package is compromised, typosquatted, or updated maliciously, users could execute untrusted code directly on their systems.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
91% confidence
Finding

The uvx envoic scan <root> --deep example is unpinned and may execute a newly resolved package version. In a scanning tool context, that code may traverse broad directory trees and access sensitive project metadata, making supply-chain compromise more consequential.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
91% confidence
Finding

The uvx envoic scan <root> --deep example is unpinned and may execute a newly resolved package version. In a scanning tool context, that code may traverse broad directory trees and access sensitive project metadata, making supply-chain compromise more consequential.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
91% confidence
Finding

This additional uvx envoic reference repeats the unsafe pattern of ephemeral execution without version constraints. Repetition across the skill increases the chance users will adopt the insecure invocation style as standard practice.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
91% confidence
Finding

This additional uvx envoic reference repeats the unsafe pattern of ephemeral execution without version constraints. Repetition across the skill increases the chance users will adopt the insecure invocation style as standard practice.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 86)May include surrounding context.

md
## Tool-Specific Surface Files

- Codex: `.agents/skills/envoic/SKILL.md` (symlink/copy of this skill)
- Cursor: `.cursorrules` (generated adapter)
- Copilot: `.github/copilot-instructions.md` (generated adapter)
- Claude: `.claude-plugin/plugins.yaml` (generated adapter)

Rp1

Medium
Category
MCP Rug Pull
Confidence
89% confidence
Finding

The uvx envoic example does not pin a specific package version, so users may execute whatever release is currently resolved by the package source. That weakens reproducibility and opens a supply-chain attack path if the published tool or its resolution path is compromised.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
89% confidence
Finding

This uvx envoic command runs an unpinned package, allowing future or compromised releases to be executed implicitly. Since the command targets broad paths like ~/projects --deep, a malicious version could traverse large portions of a user's workspace.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
89% confidence
Finding

An unpinned uvx invocation may resolve to different code over time, creating a supply-chain and reproducibility risk. Even for a JSON scan operation, executing unreviewed tool code can expose filesystem metadata or perform unintended actions.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
89% confidence
Finding

The example invokes uvx envoic without version control, which means the executed code may change without notice. In a security-sensitive sense, any command that inspects local directories should avoid implicitly trusting the latest published artifact.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
89% confidence
Finding

The --no-artifacts example still uses an unpinned uvx package execution flow, exposing users to code fetched at runtime. The lack of version pinning is the core issue, not the specific subcommand flags.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
94% confidence
Finding

The documentation instructs users to run npx envoic without pinning an exact package version, which causes code to be fetched and executed from the registry at invocation time. If the package is updated maliciously, compromised, or subject to dependency confusion/supply-chain attacks, users may execute unexpected code with their local privileges.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
89% confidence
Finding

The manage command is shown with unpinned uvx envoic, so users may run an unreviewed future build. This is more dangerous than a read-only scan because manage likely changes environments and filesystem state.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
89% confidence
Finding

The example combines a state-changing command (manage) with an unpinned package executor. That means a malicious or compromised package release could perform arbitrary additional modifications under the guise of environment management.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
89% confidence
Finding

Although --dry-run reduces operational impact, the underlying uvx envoic invocation is still unpinned and may execute untrusted code. A malicious package does not have to honor the flag semantics documented here.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
94% confidence
Finding

Using npx envoic without a version pin tells users to execute whatever version is currently served by the package registry. That creates a supply-chain risk where a compromised release or malicious takeover could lead to arbitrary code execution on developer machines.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
89% confidence
Finding

This list command executes uvx envoic without an explicit version, which is a supply-chain risk despite appearing read-only. Attackers often target developer convenience tools because users readily run them in trusted local environments.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
94% confidence
Finding

This example references npx envoic without constraining the version, so the command may run newly published code from the npm ecosystem. In a developer-tool context, that is especially risky because the tool scans and manipulates local project directories, increasing the blast radius of a malicious package.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
89% confidence
Finding

The info command also relies on floating package resolution through uvx, creating an avoidable trust gap. In this context, the tool is aimed at inspecting local environment directories, so a compromised package could exfiltrate path and environment data or tamper with files.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
94% confidence
Finding

The unpinned npx invocation exposes users to remote code execution from the latest available package version at runtime. Because this skill is aimed at cleaning development environments, a malicious package could inspect, modify, or delete sensitive local files.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The Clean section includes destructive operations, including clean ~/projects --yes, but does not warn that files may be deleted irreversibly or that broad paths can amplify damage. In the context of an environment cleanup tool, this omission is dangerous because users may treat the examples as safe defaults and remove important project artifacts unintentionally.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
89% confidence
Finding

The clean command is shown with unpinned uvx envoic, exposing users to code fetched at runtime in a destructive workflow. If the resolved package is malicious or compromised, it could delete files beyond the intended cleanup scope.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
89% confidence
Finding

Even with --dry-run, uvx envoic remains unpinned and can execute arbitrary code from the package source. The dry-run flag does not mitigate package provenance risks.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.