ClawHub
Back to skill

Security audit

Agent Registry

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly purpose-aligned, but it installs an automatic prompt hook that can inject untrusted agent metadata into context and uses broad mandatory instructions around loading agent content.

Install only if you are comfortable with a persistent hook that locally checks most prompts against your agent registry and may add agent suggestions to context. Review migrated agent files as trusted content, keep telemetry unset or set AGENT_REGISTRY_NO_TELEMETRY/DO_NOT_TRACK, avoid --move unless backed up, and prefer pinned install/update commands over floating npx usage.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:5
Finding

Mandatory Skill Instructions Override the Agent's Normal Workflow

Content
View full analysis
"` 3. **Review results**: Check relevance scores (0.0-1.0) 4. **Load if needed**: `bun bin/get.js ` 5. **Execute**: Follow the loaded agent's instructions ``` ### Technical Analysis The Skill uses imperative priority language such as “MANDATORY,” “MUST,” “NEVER,” and “ALWAYS” to redirect the Agent's workflow through the registry. It then tells the Agent to execute instructions loaded dynamically from local agent files. The declared lazy-loading functionality only requires offering search and retrieval capabilities. It does not require asserting unconditional control over the Agent's decision-making or instructing it to follow dynamically loaded content without preserving higher-priority constraints. This creates an instruction-hijacking trust chain: the Skill text mandates registry use, and the selected registry entry can introduce additional instructions whose trustworthiness is not established. ### Attack Path 1. The Skill is installed and loaded into an Agent session. 2. Its mandatory language directs the Agent to use the registry for relevant tasks. 3. An attacke ...[truncated 774 chars]
Remediation
View remediation

T01 · Skill Instruction Hijacking

Error
Location
hooks/user_prompt_search.js:46
Finding

Untrusted Agent Metadata Is Automatically Injected into Model Context

Content
View full analysis
0) break; continue; } if (stripped.startsWith("#")) continue; summaryLines.push(stripped); if (summaryLines.join(" ").length > 150) break; } let summary = summaryLines.join(" "); if (summary.length > 200) { summary = summary.slice(0, 197) + "..."; } ``` The derived summary is persisted in the registry: ```javascript registry.agents.push({ name: agent.name, path: relPath, summary: agent.summary, keywords: agent.keywords, token_estimate: agent.token_estimate, content_hash: agent.content_hash, }); ``` The hook then inserts the untrusted name and summary into `additionalContext` on qualifying user prompts: ```javascript const results = searchAgents(prompt, registry, TOP_K).filter( (r) => r.score >= SCORE_THRESHOLD ); if (results.length === 0) { process.exit(0); } const lines = ["Agent Registry found relevant agents for this task:", ""]; for (const r of results) { lines.push(` - ${r.name} (score: ${r.score.toFixed(2)}): ${r.summary}`); } lines.push(""); lines.push("To load an agent: bun bin/get.js "); console.log(JSON.stringify({ additionalContext: lines.join("\n") })); ``` ### Technical Analysis Agent Markdown files are input from user-level or project-level agent directories. Their names and textual summaries must therefore be treated as untrusted data. `extractSummary()` preserves arbitrary Markdown text other than headings and truncates it only by length. Neither registry generation ...[truncated 1638 chars]
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
install.sh:68
Finding

Installation Uses Unpinned Executable Packages and Ignores the Lockfile

Content
View full analysis
/dev/null 2>&1); then echo -e "${GREEN}✓ Optional dependencies installed via npm${NC}" elif (cd "$INSTALL_DIR" && bun install >/dev/null 2>&1); then echo -e "${GREEN}✓ Optional dependencies installed via bun${NC}" else echo -e "${YELLOW}! Could not install optional dependencies automatically${NC}" echo -e "${YELLOW}! Fallback text mode still works for init${NC}" fi fi ``` ### Technical Analysis `npx skills` resolves and executes a package without an explicit version. Separately, `@clack/prompts` is specified using a caret range. Although the repository contains a lockfile, the traditional installer does not copy it to the destination before running `npm install` or `bun install`. This makes installation ...[truncated 1313 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (31)

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

Undisclosed telemetry, fetch-based network behavior, and environment-variable-based runtime logic would materially exceed the stated purpose of an agent discovery skill. Even if telemetry is opt-in, omission from the top-level description weakens informed review and can hide data-flow and policy implications.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding

Undisclosed telemetry, fetch-based network behavior, and environment-variable-based runtime logic would materially exceed the stated purpose of an agent discovery skill. Even if telemetry is opt-in, omission from the top-level description weakens informed review and can hide data-flow and policy implications.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
93% confidence
Finding

Undisclosed telemetry, fetch-based network behavior, and environment-variable-based runtime logic would materially exceed the stated purpose of an agent discovery skill. Even if telemetry is opt-in, omission from the top-level description weakens informed review and can hide data-flow and policy implications.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

Undisclosed telemetry, fetch-based network behavior, and environment-variable-based runtime logic would materially exceed the stated purpose of an agent discovery skill. Even if telemetry is opt-in, omission from the top-level description weakens informed review and can hide data-flow and policy implications.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

Undisclosed telemetry, fetch-based network behavior, and environment-variable-based runtime logic would materially exceed the stated purpose of an agent discovery skill. Even if telemetry is opt-in, omission from the top-level description weakens informed review and can hide data-flow and policy implications.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

Undisclosed telemetry, fetch-based network behavior, and environment-variable-based runtime logic would materially exceed the stated purpose of an agent discovery skill. Even if telemetry is opt-in, omission from the top-level description weakens informed review and can hide data-flow and policy implications.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

Undisclosed telemetry, fetch-based network behavior, and environment-variable-based runtime logic would materially exceed the stated purpose of an agent discovery skill. Even if telemetry is opt-in, omission from the top-level description weakens informed review and can hide data-flow and policy implications.

Content

No source excerpt is available for this finding.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 37)May include surrounding context.

md
| `list.js` | User asks "what agents do I have" or needs overview | `bun bin/list.js` |

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 110)May include surrounding context.

md
bun bin/init.js

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 112)May include surrounding context.

md
bun bin/init.js

Intent-Code Divergence

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The comments claim that no search queries or personal information are collected, but the track function merges arbitrary caller-supplied keys and values directly into the transmitted query string. This means any caller can accidentally or deliberately send prompts, search terms, repository names, file paths, or other sensitive context, making the privacy claim misleading and increasing the chance of silent data exfiltration.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · tests/registry.test.js (reported line 51)May include surrounding context.

js
});

    test("rejects path traversal entries", () => {
      const result = resolveRegistryAgentPath("../../etc/passwd");
      expect(result.ok).toBe(false);
      expect(result.error).toContain("Refusing to load agent outside");
    });

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · CLAUDE.md (reported line 32)May include surrounding context.

md
- **`references/registry.json`** — Lightweight index storing agent metadata (name, summary, keywords, token_estimate, content_hash). This is the only file loaded into context at conversation start.
- **`agents/`** — Migrated agent markdown files, organized by subdirectory categories. Entirely git-ignored (user-specific data).
- **`lib/`** — Shared JavaScript modules (run on Bun):
  - `registry.js` — Path utilities and registry I/O (read/write registry.json, resolve skill paths).
  - `parse.js` — Agent file parsing (extract frontmatter, summary, keywords, token estimates).
  - `search.js` — BM25 + keyword matching search engine. Custom BM25 implementation (no external dependencies).
  - `telemetry.js` — Fire-and-forget anonymous telemetry using fetch. Disabled by default; opt-in via `AGENT_REGISTRY_TELEMETRY=1`. Also respects `AGENT_REGISTRY_NO_TELEMETRY=1` and `DO_NOT_TRACK=1`.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill advertises a UserPromptSubmit hook that analyzes every user prompt automatically and injects matching agents into context. Because this activation is broad and prompt-driven, it can cause unintended invocation, increase exposure to prompt-manipulation effects, and silently alter model behavior on unrelated tasks.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The README documents a --move option as a destructive migration path without an explicit warning about irreversible file relocation or potential data loss. In a skill that operates on users' agent files under home directories, this can lead to accidental destruction, broken workflows, or loss of untracked custom agents if users follow the command casually.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The README describes optional telemetry collection for a skill whose core purpose is local agent discovery and lazy loading, expanding the trust boundary beyond what users may expect from a local indexing tool. Even if disabled by default, adding network-capable telemetry increases privacy and supply-chain exposure, especially in a tool that processes user prompts and agent metadata.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding

The skill declares executable hook behavior and references shell, environment, and likely network-capable scripts, but it does not declare an explicit tool scope or permissions boundary. That makes the skill's effective capabilities opaque to users and reviewers, increasing the chance of unintended command execution or data access through the hook path.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The skill repeatedly states that Claude 'MUST' use this registry and 'NEVER' assume agents are pre-loaded, imposing mandatory behavior without user opt-in or context limitation. Forced routing through a hook-driven registry centralizes trust in this skill and can override safer or more transparent workflows, especially if the registry or hook is compromised.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The activation guidance is broad: it says to use the skill whenever a task may benefit from specialized agents, when the user asks about agents, or when starting complex workflows. Combined with the automatic prompt hook, these vague conditions can cause unnecessary interception and execution on many prompts, increasing exposure of user content and expanding the blast radius of any bug or malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
88% confidence
Finding

Using npx skills add MaTriXy/Agent-Registry@agent-registry without pinning an immutable version or digest allows installation of whatever package state resolves at execution time. This creates supply-chain risk because a later malicious or compromised release could be pulled implicitly by users following the instructions.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
86% confidence
Finding

The npx skills find instruction executes a remote package/tool path without a pinned version, so behavior may change over time or be compromised upstream. Even discovery commands can expose users to unreviewed code execution in their local environment.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
88% confidence
Finding

The npx skills update instruction is especially risky because it encourages fetching and executing the latest remote code without version constraints. In a skill that already manages local agent files and hooks, an upstream compromise could directly affect local workflow behavior.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.env_credential_access

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
tests/cli.test.js:13

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
lib/telemetry.js:34