ClawHub
Back to skill

Security audit

TeamPilot

Security checks for vulnerabilities and agentic risk

Overview

The skill is a small TeamPilot setup guide, but it tells users to run code from an unspecified repository without provenance or verification guidance.

Review this skill before installing or following it. Only use a known official TeamPilot repository, inspect package scripts and lockfiles first, and run the initial setup in an isolated environment without sensitive credentials or production access.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Error
Location
SKILL.md:14
Finding

Unverified Repository and Dependency Execution

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 14-20
Vulnerability Type: Unverified external repository and unsafe dependency installation
Risk Level: High

Vulnerable Code

markdown
2. Clone repository:
   - `git clone <TEAM_PILOT_REPO_URL> team-pilot`
   - `cd team-pilot`
3. Install dependencies:
   - `npm install`
4. Start service:
   - `npm run up`

Technical Analysis

The Skill directs the user to clone a repository from an unconstrained placeholder URL and immediately run repository-controlled npm commands. It does not identify a trusted repository host, pin an immutable commit, require signature or checksum verification, or instruct the user to inspect the repository before execution.

Running npm install may execute npm lifecycle scripts defined by the cloned repository or its dependencies, including preinstall, install, and postinstall. Running npm run up subsequently executes a command defined by the repository's package.json. A malicious repository or compromised dependency can therefore cause arbitrary code to run with the invoking user's privileges.

This is a supply-chain risk rather than evidence that the Skill itself contains an embedded malicious payload. The audited package contains only SKILL.md; no local scripts or concrete malicious dependencies were present for further verification.

Attack Path

  1. An attacker supplies, substitutes, or compromises the repository referenced by <TEAM_PILOT_REPO_URL>.
  2. The user follows the Skill and clones the attacker-controlled repository.
  3. The user runs npm install.
  4. A malicious package or repository-defined lifecycle script executes arbitrary commands.
  5. The user runs npm run up, providing another execution path through a repository-defined script.
  6. The malicious code operates with the user's current OS privileges and can access resources available to that account.

Impa

...[truncated 676 chars]

Remediation
View remediation

Remediation Suggestions

  1. Replace the repository placeholder with the official HTTPS repository URL on a trusted host.
  2. Pin installation instructions to a reviewed, immutable commit hash or cryptographically signed release tag.
  3. Require verification of release signatures or published checksums before running repository content.
  4. Require and review a committed npm lockfile, then use npm ci rather than an unconstrained npm install.
  5. Initially install with npm ci --ignore-scripts where operationally feasible.
  6. Review the root package's lifecycle and npm scripts, as well as dependency lifecycle scripts, before enabling script execution.
  7. Run dependency auditing and provenance checks, including npm audit, while recognizing that automated auditing does not replace source review.
  8. Execute the application in an isolated, least-privileged container or disposable environment without production credentials, sensitive mounts, or unnecessary network access.
  9. Document the expected npm run up command and behavior so users can compare it against the reviewed implementation before execution.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep