ClawHub
Back to skill

Security audit

swiftfindrefs

Security checks for vulnerabilities and agentic risk

Overview

This skill is coherent and purpose-aligned for Swift reference discovery, with a disclosed but unpinned third-party Homebrew install as the main caution.

Before installing, verify that you trust the swiftfindrefs Homebrew tap and consider pinning or auditing the exact repository revision in managed environments. Expect the tool to read Xcode indexing data and return absolute source file paths for Swift projects.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:23
Finding

Unpinned Third-Party Homebrew Tap Enables Supply-Chain Compromise

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 23-26
Vulnerability Type: Unpinned third-party dependency installation
Risk Level: Medium

Vulnerable Code

markdown
## Installation
```bash
brew tap michaelversus/SwiftFindRefs https://github.com/michaelversus/SwiftFindRefs.git
brew install swiftfindrefs
text

### Technical Analysis

The installation instructions add a third-party Homebrew tap directly from a mutable GitHub repository and then install its `swiftfindrefs` formula without pinning a reviewed commit, release, formula digest, or immutable artifact.

The effective installation payload can therefore change after this skill has been audited. If the upstream repository, maintainer account, release infrastructure, or formula is compromised, a later invocation of these commands could download and execute attacker-controlled installation logic. Homebrew formula installation may execute build scripts and installation actions under the privileges of the user running Homebrew.

The issue is a supply-chain trust weakness rather than evidence that the currently referenced repository is malicious. The skill does not automatically run the installation commands, but users or agents following its documented setup procedure may execute them.

### Attack Path

1. An attacker compromises the referenced GitHub repository, a maintainer account, or an upstream artifact used by its Homebrew formula.
2. The attacker modifies the tap formula or referenced release artifact to include malicious installation or build behavior.
3. A user or agent follows the documented instructions and runs `brew tap` followed by `brew install swiftfindrefs`.
4. Homebrew retrieves the current mutable formula and its dependencies from the compromised source.
5. The malicious formula, build process, or installed executable runs with the permissions of the Homebrew user.
6. Subsequent skill operations invoke the compromised `swiftfindrefs` executable, potentially expos
...[truncated 728 chars]
Remediation
View remediation

Remediation Suggestions

  • Replace the mutable tap installation procedure with a dependency obtained from a trusted, controlled distribution channel.
  • Pin the dependency to a specific reviewed release and immutable commit.
  • Verify downloaded source or binary artifacts against a published cryptographic checksum before installation.
  • Prefer signed releases and document how users must verify the signature against a separately authenticated maintainer key.
  • If the tap must remain in use, pin and audit the exact formula revision rather than implicitly trusting the repository's latest state.
  • Record the expected dependency version and integrity value in the skill documentation.
  • In managed or CI environments, mirror the reviewed formula and artifacts into an organization-controlled registry.
  • Run the tool with ordinary user permissions and without access to secrets or unrelated sensitive directories.
  • Re-audit the dependency before updating the pinned version.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.