ClawHub
Back to skill

Security audit

3232

Security checks for vulnerabilities and agentic risk

Overview

This is a legitimate AI-skill manager, but it asks agents to run unpinned tooling and make broad skill changes without enough confirmation safeguards.

Install only if you trust the @tiktok-fe/skills package and are comfortable letting an agent manage skill files that affect future AI-agent behavior. Prefer pinned package versions, review update lists before applying changes, avoid blanket --force or -y on destructive commands, limit actions to project scope or specific agents, and disable telemetry if you do not want install metadata uploaded.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T08 · Insecure Dependencies

Error
Location
SKILL.md:10
Finding

Unpinned External CLI Installation and Execution

Content
View full analysis
Remediation
View remediation

other

Note
Location
llms/commands/add.txt:90
Finding

Installation Telemetry Is Enabled by Default

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (32)

Self-Modification

High
Category
Rogue Agent
Confidence
85% confidence
Finding

The workflow includes creating a new skill, editing SKILL.md, and publishing it, which enables the agent to produce and distribute new executable instructions that affect future agent behavior. In the context of a skill-management system, self-modification and publication are especially sensitive because they can propagate unsafe logic or persistence beyond the current session.

Content

Scanner excerpt · SKILL.md (reported line 161)May include surrounding context.

bash
ai-skills whoami --json
ai-skills init --name my-skill --template basic --pure
# (edit SKILL.md)
ai-skills publish --dir ./my-skill --pure -y

Self-Modification

High
Category
Rogue Agent
Confidence
85% confidence
Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · llms/cli-overview.txt (reported line 78)May include surrounding context.

text
In Pure mode:
- All output goes through `console.log` (no ANSI escape codes)
- No interactive prompts — operations that need confirmation silently skip or fail
- `shouldOverwrite` always returns `false` — use `--force` to overwrite existing skills
- Error messages use `Error: <reason>` format

## Source Platforms

Self-Modification

High
Category
Rogue Agent
Confidence
85% confidence
Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · llms/commands/add.txt (reported line 40)May include surrounding context.

text
| `-s, --soft` | Use symlink mode (shared storage) |
| `--no-soft` | Force hard copy mode |
| `-a, --agents <names>` | Specify agent(s) to install to (comma-separated) |
| `-f, --force` | Overwrite existing skills without prompt |
| `--cli` | Interactive mode (default) |
| `--pure` | Plain text output mode |

Self-Modification

High
Category
Rogue Agent
Confidence
85% confidence
Finding

Updating project skills is a form of self-modification: the tool changes the skill files that agents rely on for future behavior. This is especially sensitive because project-scoped skills may directly affect repository-local agent actions, so an unsafe update can alter behavior in a targeted workspace.

Content

Scanner excerpt · llms/commands/update.txt (reported line 25)May include surrounding context.

text
|--------|-------------|
| `-p, --project` | Update project skills (default) |
| `-g, --global` | Update global skills |
| `-t, --target <dir>` | Update skills in custom directory |
| `--dir <dir>` | Update skills in exact directory |
| `-a, --agents <names>` | Filter by specific agent(s) |
| `--filter <name>` | Update only the named skill |

Self-Modification

High
Category
Rogue Agent
Confidence
85% confidence
Finding

Updating global skills modifies shared agent behavior across multiple projects and sessions, amplifying the effect of any bad or compromised update. The documentation presents this as a routine operation without emphasizing that it changes trusted agent instructions at a broad scope.

Content

Scanner excerpt · llms/commands/update.txt (reported line 26)May include surrounding context.

text
| `-p, --project` | Update project skills (default) |
| `-g, --global` | Update global skills |
| `-t, --target <dir>` | Update skills in custom directory |
| `--dir <dir>` | Update skills in exact directory |
| `-a, --agents <names>` | Filter by specific agent(s) |
| `--filter <name>` | Update only the named skill |
| `-y, --yes` | Skip confirmation prompts |

Self-Modification

High
Category
Rogue Agent
Confidence
95% confidence
Finding

The instruction to always use --force for overwrites tells an agent to replace existing installed skills without confirmation. Because skills influence agent behavior, forced overwrite is a direct self-modification path that can replace a trusted skill with different content, potentially introducing malicious or incompatible behavior.

Content

Scanner excerpt · llms/guides/ai-best-practices.txt (reported line 51)May include surrounding context.

text
### 4. Use `--force` for Overwrites

In pure mode, `shouldOverwrite` always returns `false`. Use `--force` to overwrite existing skills:

```bash
# ✅ Correct — Force overwrite

Self-Modification

High
Category
Rogue Agent
Confidence
85% confidence
Finding

This guidance normalizes self-modification of the agent's skill environment through update operations, including non-interactive application flows elsewhere in the file. For an agent, changing its own installed skills can alter future behavior, capabilities, or trust boundaries, creating persistence and supply-chain risk if updates are unreviewed or triggered automatically.

Content

Scanner excerpt · llms/guides/ai-best-practices.txt (reported line 118)May include surrounding context.

text
ai-skills remove skill-name --global --pure --force
```

### Update Skills

```bash
# Check for updates

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The activation description is very broad and matches many generic requests about finding, installing, updating, publishing, or managing skills across multiple agents. That over-breadth can cause the skill to trigger in situations the user did not specifically intend, increasing the chance of unnecessary package-management actions or exposure to other risky instructions in the skill.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
94% confidence
Finding

The skill instructs use of npx @tiktok-fe/skills without pinning a specific version, so each invocation may fetch and execute whatever package version is current at runtime. In an agent context, that creates supply-chain risk and makes behavior non-reproducible; a compromised or maliciously updated package could be executed automatically.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
86% confidence
Finding

The guidance explicitly recommends auto-confirm flags such as -y and --force so the agent can bypass interactive confirmation for update, add, remove, clean, and publish flows. In a skill-management tool, removing human confirmation increases the chance that an agent performs destructive or trust-sensitive operations without adequate user approval.

Content

Scanner excerpt · SKILL.md (reported line 50)May include surrounding context.

md
# WRONG — will hang on confirmation prompt
ai-skills update --project --pure

# CORRECT — auto-confirm
ai-skills update --project --pure -y

# WRONG — will hang on clean confirmation

Rp1

Medium
Category
MCP Rug Pull
Confidence
93% confidence
Finding

The documentation instructs users and agents to execute npx @tiktok-fe/skills without pinning a specific version, which causes retrieval and execution of whatever package version is current at runtime. In an agent skill-management context, this increases supply-chain risk because a compromised or maliciously updated package could be run immediately with the user's privileges.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The command explicitly supports installing skills from external Git repositories and URLs into local agent directories, which can alter the user's local environment. The documentation does not present a clear trust warning, integrity verification requirement, or review step before installing content from untrusted sources, increasing supply-chain risk for skills that may contain unsafe instructions or files.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The documentation includes a reset-all capability that can overwrite user settings without any documented confirmation prompt, warning, or recovery guidance. In an agent-driven context, this increases the chance of accidental destructive configuration changes, especially if an agent issues the command on the user's behalf.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

This plain-text command description defines search as an alias without narrowing context or providing exclusion conditions. Because search is a very generic term, it could collide with unrelated user intents and cause unintended invocation of this skill.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · llms/commands/init.txt (reported line 24)May include surrounding context.

text
| `-n, --name <name>` | Skill name (if omitted, prompts or uses current directory name) |
| `-d, --description <text>` | Skill description (written to SKILL.md front matter; if omitted, prompts or uses default) |
| `-t, --template <type>` | Template: `basic` or `advanced` (or a path to existing skill dir) |
| `-y, --yes` | Skip prompts, use defaults |
| `--cli` | Interactive mode (default) |
| `--pure` | Plain text output mode |

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · llms/commands/clean.txt (reported line 28)May include surrounding context.

text
|--------|-------------|
| `-d, --dir <path>` | Path to skill directory (defaults to current directory) |
| `-v, --version <ver>` | Version to publish (auto-increments if omitted) |
| `-y, --yes` | Skip confirmation prompts |
| `--cli` | Interactive mode (default) |
| `--pure` | Plain text output mode |

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · llms/commands/publish.txt (reported line 25)May include surrounding context.

text
|--------|-------------|
| `-d, --dir <path>` | Path to skill directory (defaults to current directory) |
| `-v, --version <ver>` | Version to publish (auto-increments if omitted) |
| `-y, --yes` | Skip confirmation prompts |
| `--cli` | Interactive mode (default) |
| `--pure` | Plain text output mode |

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · llms/commands/unpublish.txt (reported line 29)May include surrounding context.

text
|--------|-------------|
| `-d, --dir <path>` | Path to skill directory (defaults to current directory) |
| `-v, --version <ver>` | Version to publish (auto-increments if omitted) |
| `-y, --yes` | Skip confirmation prompts |
| `--cli` | Interactive mode (default) |
| `--pure` | Plain text output mode |

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · llms/commands/unpublish.txt (reported line 64)May include surrounding context.

text
# Unpublish a specific version
ai-skills unpublish myuser/skills/my-skill --version 1.0.0

# Unpublish entire skill (skip confirmation)
ai-skills unpublish myuser/skills/my-skill --all --force

# Pure mode

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The command explicitly supports applying updates to installed skills, including unattended use via --yes, but the documentation does not warn that updates can overwrite existing skill files and materially change agent behavior. In the context of agent skills, silent updates increase supply-chain and integrity risk because users may approve automation without understanding that executable prompts/configuration are being replaced.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

The -y, --yes option skips confirmation prompts for updates, which means the tool can make consequential changes to installed skill definitions without a human checkpoint. In an agent-skill ecosystem, this increases the chance of unsafe behavior changes or supply-chain compromise being adopted automatically.

Content

Scanner excerpt · llms/commands/update.txt (reported line 29)May include surrounding context.

text
| `--dir <dir>` | Update skills in exact directory |
| `-a, --agents <names>` | Filter by specific agent(s) |
| `--filter <name>` | Update only the named skill |
| `-y, --yes` | Skip confirmation prompts |
| `-l, --list` | List available updates without applying |
| `--include-external` | Include externally sourced skills in update check |
| `--cli` | Interactive mode (default) |

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
87% confidence
Finding

--yes is documented as applying updates without confirmation, enabling autonomous modification of installed skills. Because skills influence downstream agent behavior, removing human review can allow unintended or malicious upstream changes to propagate automatically across environments.

Content

Scanner excerpt · llms/commands/update.txt (reported line 50)May include surrounding context.

text
Same logic but all output via `console.log`:
- Lists each skill with current → available version
- `--list` mode: Shows updates without applying
- `--yes`: Applies without confirmation
- `--filter`: Only checks/updates the specified skill

## Examples

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

This markdown file documents that the command outputs username, real name, and email for the authenticated user, but it does not include any warning that personally identifiable information will be displayed or emitted in JSON. Because the skill affects user privacy by revealing account identity data, the description should disclose that behavior clearly.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

The file presents user-facing output and sample identity data using Chinese-specific values such as '张三' with no indication that this skill is region-specific or that language/locale may vary. This can constitute a language/locale policy issue because the documentation implicitly fixes a specific locale without user opt-in or justification.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
85% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · llms/guides/agents-list.txt (reported line 60)May include surrounding context.

text
```bash
ai-skills add my-skill --source local --project --pure
# Installs to: .cursor/skills/my-skill, .claude/skills/my-skill, etc.
```

### Global-Level

Static analysis

No suspicious patterns detected.