Haskell

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 7:54 PM UTC
• Version: 1.0.0

Overview

This is a coherent Haskell guidance skill with some examples and install instructions users should review before running.

Before installing, consider using a pinned ClawHub CLI version or a trusted existing `clawhub` install instead of `npx ...@latest`. When using the Nix and Cabal examples, review commands that start PostgreSQL, write editor settings, create symlinks, or upload to Hackage before running them.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: README.md:72

Finding

Unpinned npm Package Retrieval and Execution

Content

View full analysis

Vulnerability Details

File Location: README.md:72
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Complete Code Snippet:

bash

npx clawhub@latest install haskell

Technical Analysis

The installation guidance directs users to execute the mutable latest release of the clawhub npm package. When the package is not already cached, npx retrieves it from the configured npm registry and executes its CLI code with the permissions of the invoking user.

Because latest is a mutable distribution tag rather than an immutable, audited version, the code ultimately executed can change after this Skill has been reviewed. A compromised package maintainer account, registry package takeover, malicious new release, or compromised dependency could therefore turn this documented installation command into a remote code-execution path.

The network access is relevant to installing the Skill, but selecting and executing an unpinned release exceeds the minimum necessary supply-chain trust. Installation can instead use an exact reviewed version and integrity verification.

Attack Path

1. An attacker compromises the clawhub npm package, its maintainer account, publishing pipeline, or a dependency executed during installation.
2. The attacker publishes a malicious release and assigns it the latest distribution tag.
3. A user follows the command documented in README.md.
4. npx downloads the current package associated with latest.
5. The package's CLI or lifecycle code executes locally before the user can meaningfully inspect the retrieved implementation.
6. The malicious code acts with the invoking user's permissions and can access resources available to that user.

Impact Assessment

Successful exploitation could provide arbitrary code execution under the account running the command. Depending on that account's environment and permissions, the malicious package could read ...[truncated 414 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace @latest with an exact version that has been reviewed, for example:

   bash

   npx clawhub@X.Y.Z install haskell
   

2. Verify the selected package version's provenance, publisher, release history, and integrity before documenting it.
3. Where practical, use a lockfile and npm integrity metadata to make dependency resolution reproducible.
4. Prefer invoking a separately installed, trusted CLI rather than combining remote retrieval and execution in one command.
5. Document that users should not run the installer with sudo or an administrator account.
6. Establish an update process in which version changes are explicitly reviewed before the pinned command is revised.
7. Consider documenting a manual download-and-verification path for security-sensitive environments.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The README instructs users to execute npx clawhub@latest install haskell, which fetches and runs the latest published package version at install time rather than a pinned, reviewed version. This creates a supply-chain risk: if the package is compromised, typo-squatted, or a bad update is published, users of the skill may execute attacker-controlled code during installation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The activation text is broad enough to trigger on ordinary Haskell-related discussion, not just cases where the specialized skill is clearly needed. Overbroad activation can cause unnecessary routing to this skill, expanding its influence and increasing the chance that embedded guidance or future unsafe additions are applied in unintended contexts.

Content

No source excerpt is available for this finding.

Behavior Manipulation

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Subtle instructions detected that may alter agent decision-making or introduce hidden biases.

Content

Scanner excerpt · references/libraries.md (reported line 93)May include surrounding context.

md

import qualified Data.Text.IO as T
import qualified Data.Text.Encoding as T

-- Always prefer Text over String
processText :: Text -> Text
processText = T.toUpper . T.strip . T.filter (/= ' ')

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The database shellHook automatically initializes a PostgreSQL data directory, starts a local database server, and creates a database on shell entry. Even though it is aimed at developer convenience and constrained to the local workspace, it performs state-changing actions and launches a service without an explicit warning or opt-in, which can surprise users and create unintended local exposure or data modification.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

This markdown file includes cabal upload commands that transmit package contents to Hackage, but the surrounding instructions do not warn that this performs a network action and may publicly publish release artifacts. For markdown files, user-facing documentation should disclose behaviors that can affect data sharing or external systems.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The shellHook creates directories, writes .vscode/settings.json, and creates symlinks in the workspace automatically. In documentation, this is risky because users may paste or adopt it without realizing it modifies editor configuration and can overwrite existing settings, causing unexpected workspace changes.

Content

No source excerpt is available for this finding.