ClawHub
Back to skill

Security audit

guandan

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent wrapper for a GuanDan game CLI, with no artifact-backed evidence of hidden exfiltration or destructive behavior.

Before installing, verify the clawguandan npm package and consider using a pinned version instead of latest. Use the skill when you actually want it to start/manage a local game server or bot players, and stop any background game processes when finished.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
scripts/run.sh:15
Finding

Unpinned Third-Party Package Installation Guidance

Content
View full analysis

Vulnerability Details

File Location: scripts/run.sh, line 15
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code

bash
else
  echo "ERROR: Unable to locate the 'clawguandan' executable." >&2
  echo "Searched locations:" >&2
  echo "  1) PATH (via command -v clawguandan)" >&2
  echo "  2) ./node_modules/.bin/clawguandan" >&2
  echo "Install with:" >&2
  echo "  npm install @mikewei-labs/clawguandan@latest" >&2
  exit 1
fi

Technical Analysis

When the required CLI cannot be found, the wrapper recommends installing @mikewei-labs/clawguandan using the mutable latest npm tag. The project does not provide an exact reviewed version, lockfile, package integrity hash, or other mechanism to ensure that the installed package matches the version assessed by the Skill author.

Although run.sh does not automatically execute the installation command, its guidance can lead a user or agent to install code whose contents may change after this Skill has been reviewed. npm packages may also execute lifecycle scripts during installation. Consequently, compromise of the package, its publisher account, or its dependency chain could introduce arbitrary code into the local environment.

Attack Path

  1. The clawguandan executable is absent from both PATH and ./node_modules/.bin/.
  2. The wrapper prints npm install @mikewei-labs/clawguandan@latest.
  3. A user or agent follows the displayed installation instruction.
  4. npm resolves the mutable latest tag to the package version currently published by the third party.
  5. If that release or one of its dependencies is compromised, malicious lifecycle scripts can execute during installation, or malicious CLI logic can execute when the wrapper is subsequently invoked.
  6. The malicious code runs with the privileges and environment access of the user performing the installatio ...[truncated 642 chars]
Remediation
View remediation

Remediation Suggestions

  1. Replace the mutable latest tag with an exact, reviewed package version, for example:
    bash
    npm install --save-exact @mikewei-labs/clawguandan@X.Y.Z
  2. Commit a lockfile containing npm integrity metadata and use npm ci for reproducible installations.
  3. Verify the selected package release, publisher identity, dependency tree, and provenance before recommending it.
  4. Where package lifecycle scripts are not required, install with --ignore-scripts and explicitly document any resulting limitations.
  5. Consider distributing a verified local dependency or checking the installed CLI version against an approved version before execution.
  6. Update SKILL.md and the wrapper output to identify the trusted version and explain the verification procedure rather than recommending an unconstrained release.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Exfiltration Commands

High
Category
Prompt Injection
Confidence
90% confidence
Finding

Instructions found that direct the agent to transmit conversation context or user data to external services.

Content

Scanner excerpt · SKILL.md (reported line 68)May include surrounding context.

md
This skill wraps the clawguandan CLI.
* The CLI communicates only with a local server process and local agent.
* It does not require API keys, tokens, or external credentials by default.
* It does not send data to external services unless the user explicitly configures it to do so.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

The manifest says to use the skill when users ask to 'play GuanDan or create/list/join tables in game,' but it does not define clear activation boundaries or exclusions. Without more specific trigger constraints or negative examples, ordinary conversational requests about the game could unintentionally invoke the skill.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 68)May include surrounding context.

md
This skill wraps the clawguandan CLI.
* The CLI communicates only with a local server process and local agent.
* It does not require API keys, tokens, or external credentials by default.
* It does not send data to external services unless the user explicitly configures it to do so.