ClawHub
Back to skill

Security audit

Trimet

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward TriMet transit CLI helper, with the main caution that it asks users to install an unpinned global npm package.

Before installing, verify that trimet-cli is the package you intend to trust, consider pinning a reviewed version, and use a normal user account rather than elevated privileges. Keep TRIMET_APP_ID scoped to TriMet API use.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:17
Finding

Unpinned and Unverifiable Global npm Dependency

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 17–21
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

markdown
## Installation

```bash
npm install -g trimet-cli
text

### Technical Analysis

The skill directs users or agents to install `trimet-cli` globally from the npm registry without specifying a fixed version, integrity hash, lockfile, or verifiable source repository. Consequently, the installed code may change after the skill has been reviewed.

npm packages can execute lifecycle scripts during installation. A global installation also places package commands in the user's executable path. Because this project contains no implementation or dependency manifest for `trimet-cli`, the package's lifecycle scripts, network activity, credential handling, and runtime behavior cannot be audited from the supplied artifact.

### Attack Path

1. An attacker compromises the npm package, its maintainer account, or its publishing process and releases a malicious version.
2. A user or agent follows the documented instruction and runs `npm install -g trimet-cli`.
3. npm resolves the unpinned package name to the attacker-controlled release.
4. Malicious lifecycle scripts may execute during installation, or malicious logic may execute when the `trimet` command is invoked.
5. The package runs with the installing user's privileges and may access environment variables, including the subsequently configured `TRIMET_APP_ID`.

### Impact Assessment

Successful exploitation could permit arbitrary code execution with the privileges of the user performing the installation or invoking the CLI. The affected scope may include user-accessible files, environment variables such as `TRIMET_APP_ID`, outbound network access, and user-level executable-path modifications. If installation is performed by a privileged account, the impact would increase accordingly. The reviewed artifact does not prove that the
...[truncated 111 chars]
Remediation
View remediation

Remediation Suggestions

  • Pin trimet-cli to a specific, reviewed version rather than resolving the latest release implicitly.
  • Document the package's official source repository and verify that its npm publisher, repository, and TriMet affiliation are trustworthy.
  • Record and verify package integrity or provenance before installation.
  • Audit the selected release, including npm lifecycle scripts, transitive dependencies, network destinations, and handling of TRIMET_APP_ID.
  • Prefer a project-local dependency governed by a committed lockfile instead of a global installation.
  • Disable lifecycle scripts during installation where compatible, and run the CLI with least privilege in a restricted environment.
  • Establish an update-review process so version changes are audited before the pinned dependency is advanced.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.