Ccclub

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:05 AM UTC
• Version: 1.0.2

Overview

The skill is clear about its leaderboard purpose, but setup runs an unpinned external package and automatically installs background sync with limited control details.

Review before installing. Only run setup if you trust the `ccclub` npm package and are comfortable with a background sync process periodically reading coding-agent usage logs and uploading summarized usage/cost data to ccclub.dev. Prefer a pinned, verifiable package version and look for clear commands to inspect, disable, and uninstall the background sync.

A.I.G

Vulnerability Patterns

• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T06 · System Persistence

Error

• Location: SKILL.md:44

Finding

Automatic Installation of a Persistent Background Synchronization Mechanism

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 44–48
Vulnerability Type: Automatic cross-session persistence
Risk Level: High

Vulnerable snippet:

markdown

## Setup (first time)

- Create a group: `npx ccclub init` (interactive: asks display name once)
- Join a friend's group: `npx ccclub join <6-LETTER-CODE>`
- Both install background sync automatically; nothing else to configure.

Technical Analysis

The documented initialization and group-joining operations automatically install an unspecified background synchronization mechanism. This mechanism survives the immediate Skill execution and continues collecting local coding-agent usage information and transmitting aggregated data.

The documentation does not identify the type of persistence installed, its execution schedule, the files or services it creates, the privileges it uses, or a procedure for disabling and removing it. Because the project contains only SKILL.md, the implementation cannot be reviewed to verify the claimed limitation that prompts, source code, and file paths are excluded from uploads.

Installing recurring background execution without a separate, informed opt-in breaks the expectation that running a setup command has effects limited to the current operation.

Attack Path

1. A user asks the Agent to create or join a leaderboard.
2. Following SKILL.md, the Agent executes npx ccclub init or npx ccclub join <6-LETTER-CODE>.
3. The downloaded package executes with the user's privileges.
4. Setup automatically installs a background synchronization component.
5. The component survives the original Skill run and periodically reads local coding-agent usage logs.
6. Derived usage and cost information is repeatedly transmitted to the external ccclub.dev service.
7. If the package or synchronization implementation is compromised, the persistent component could perform additional actions under ...[truncated 686 chars]

Remediation

View remediation

Remediation Suggestions

• Do not install background synchronization as an automatic side effect of initialization or group joining.
• Default to manual synchronization and require a separate, explicit opt-in before enabling recurring execution.
• Clearly identify the persistence mechanism, including service names, scheduled tasks, created files, execution intervals, and privilege requirements.
• Provide documented commands to inspect, disable, and completely uninstall the synchronization component.
• Display the exact local data sources and network fields before obtaining consent.
• Provide auditable source code for the synchronization implementation and enforce technical controls that prevent access to prompts, code, file paths, credentials, and unrelated files.
• Run the component with the minimum required privileges and restrict its filesystem and network access through sandboxing where available.

T08 · Insecure Dependencies

Error

• Location: SKILL.md:46

Finding

Execution of an Unpinned Third-Party Package Through npx

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 46–47
Vulnerability Type: Mutable and unverified third-party dependency execution
Risk Level: High

Vulnerable snippet:

markdown

- Create a group: `npx ccclub init` (interactive: asks display name once)
- Join a friend's group: `npx ccclub join <6-LETTER-CODE>`

Technical Analysis

The setup instructions invoke npx ccclub without specifying an audited package version, integrity digest, trusted source commit, or lockfile. Depending on the local npm configuration and cache state, npx can retrieve the current registry release and immediately execute its code.

Consequently, the effective code executed during setup is mutable after the Skill has been reviewed. A compromised maintainer account, malicious package update, registry compromise, or unexpected dependency change could cause arbitrary package code to run under the user's identity. The risk is amplified because the package is also documented as installing a persistent background synchronization component.

The repository contains no package source, dependency manifest, integrity metadata, or implementation that would allow the invoked software to be reviewed as part of this audit.

Attack Path

1. An attacker compromises the published ccclub package, its maintainer account, or a transitive dependency.
2. The attacker publishes a malicious version under the same package name.
3. The Agent follows the Skill and executes an unversioned npx ccclub init or npx ccclub join.
4. npx retrieves the mutable package version from the configured registry.
5. Package code executes locally with the invoking user's privileges.
6. The malicious code accesses user-readable files, uses available network connectivity, or abuses the package's background-sync installation behavior to establish persistent execution.

Impact Assessment

A malicious package can generally perform any ...[truncated 568 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the CLI to a specific reviewed version, such as npx ccclub@X.Y.Z, rather than resolving the latest release.
• Verify package integrity using an approved lockfile, registry integrity metadata, signatures, or published cryptographic checksums.
• Link to a verifiable source repository and ensure the distributed package is reproducibly built from the reviewed source.
• Audit direct and transitive dependencies and use automated monitoring for compromised or unexpectedly changed releases.
• Prefer installing from an organization-controlled registry or other explicitly trusted source.
• Avoid combining remotely retrieved code execution with automatic persistence installation.
• Before execution, inform the user that npx may download and run third-party code and obtain explicit consent.
• Execute setup in a sandbox with restricted filesystem, environment-variable, credential, and network access.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The skill instructs users to run npx ccclub init, which fetches and executes the latest package code at runtime without a pinned version. If the npm package is compromised, typo-squatted, or a malicious update is published, users could execute attacker-controlled code on their machine during setup.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The skill instructs users to run npx ccclub join <6-LETTER-CODE>, which also causes npx to resolve and execute the current package version from npm without version pinning. This creates a supply-chain execution risk: a compromised upstream package or malicious republish could run arbitrary code under the user's privileges.

Content

No source excerpt is available for this finding.