ClawHub
Back to skill

Security audit

Web Architecture

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent development workflow skill, but its bundled project guidance can lead agents to implement session replay and error analytics that expose user data without enough privacy controls.

Review before installing or using this skill in automated builds. Pin all CLI and dependency versions, run generators in a restricted environment without production secrets, and change the bundled telemetry guidance to disable or tightly mask session replay, avoid sending email or full domain objects to Sentry/PostHog, and add consent, opt-out, retention, and redaction requirements.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T09 · Insecure Skill Coding Practices

Error
Location
TECH-REQ.md:509
Finding

Unmasked Session Replay Can Transmit Sensitive User Data to Sentry

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
CODING-STANDARDS.md:1390
Finding

Sentry Examples Transmit User Email and Shopping-Cart Data Without Redaction

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
TECH-REQ.md:423
Finding

Unpinned Latest Package Is Downloaded and Executed During Project Setup

Content
View full analysis
Remediation
View remediation
init bunx shadcn@ add button card dialog form input ``` 2. Record the exact package and transitive dependency versions in a committed lockfile. 3. Require frozen-lockfile installation in both development automation and CI. 4. Verify registry provenance, package signatures or attestations, and expected integrity hashes where supported. 5. Run project generators in a restricted container without production secrets, SSH agents, cloud credentials, or unrestricted filesystem access. 6. Review generated diffs before committing or executing generated code. 7. Apply automated dependency scanning and controlled update review instead of silently tracking mutable `latest` releases. 8. Pin other technologies specified as `latest` in `TECH-REQ.md` to tested version ranges or exact versions. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (11)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 270)May include surrounding context.

md
- [CODING-STANDARDS.md](./CODING-STANDARDS.md) — TypeScript/React/Convex patterns

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · TECH-REQ.md (reported line 538)May include surrounding context.

Required Variables

bash
# .env.local

# ─────────────────────────────────────────────────────────────
# Core Application

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · TECH-REQ.md (reported line 650)May include surrounding context.

Required Variables

bash
# .env.local

# ─────────────────────────────────────────────────────────────
# Core Application

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · TECH-REQ.md (reported line 651)May include surrounding context.

Required Variables

bash
# .env.local

# ─────────────────────────────────────────────────────────────
# Core Application

Rp1

Medium
Category
MCP Rug Pull
Confidence
85% confidence
Finding

The skill instructs users to run npx convex dev --once without pinning a specific package version. Unpinned npx execution can fetch and run whatever version is current at execution time, which creates supply-chain and reproducibility risk if a compromised or incompatible release is published.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
85% confidence
Finding

This command again directs execution of npx convex dev without a pinned version. In a multi-agent workflow skill, such commands may be copied and executed automatically or semi-automatically, increasing the chance of running an unexpected upstream package version.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
84% confidence
Finding

The deliverables section depends on generated artifacts from an unpinned npx convex workflow, which implicitly normalizes running a remote package without version control. That exposes users to upstream compromise, breaking changes, or environment-dependent behavior.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
84% confidence
Finding

The QA phase includes npx convex dev --once without version pinning, repeating the same supply-chain risk later in the lifecycle. Because this appears in a final verification step, it is especially likely to be executed routinely by operators or agents, magnifying exposure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The document requires PostHog analytics and session replay, including user identification via Clerk ID, but does not require any user-facing notice, consent flow, or privacy control. Session replay can capture sensitive user interactions and personal data, so omitting disclosure and consent requirements creates a real privacy and compliance risk, especially under GDPR/CCPA.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The Sentry replay configuration explicitly sets maskAllText: false and blockAllMedia: false, which increases the chance that user-entered content and on-screen sensitive data will be recorded during session/error replay. Because the specification does not pair this with disclosure, consent, or strict masking requirements, it meaningfully raises privacy exposure.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The example root layout sets lang="en", which is natural-language guidance prescribing an English locale. Under the policy, forcing a specific language/locale without user opt-in can be a violation, and the document does not note that this is optional or limited to an English-only product.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.