ClawHub
Back to skill

Security audit

Prototype Factory

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent prototype-building guide with expected project scaffolding and dependency-install instructions, but users should review the stack and packages before running them.

Before installing or using this skill, confirm the desired stack and branding so the agent does not default to Flutter or the neon design language unintentionally. Run package installation commands in an isolated project environment, review generated lockfiles and dependencies, and avoid exposing unnecessary secrets while scaffolding prototypes.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:48
Finding

Unpinned Third-Party Dependency Retrieval and Execution

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 48–49 and 61–62
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Complete Code Snippets:

bash
flutter create <project>
cd <project>
flutter pub add google_fonts cached_network_image go_router lottie
bash
npm create vite@latest prototype -- --template react-ts
cd prototype
npm install framer-motion tailwindcss @radix-ui/themes

Technical Analysis

The commands retrieve third-party packages without pinning exact versions or enforcing reviewed integrity values. In particular, npm create vite@latest explicitly selects the latest available initializer and executes package-supplied code. The remaining package installation commands resolve mutable dependency versions and transitive dependency graphs at installation time.

Consequently, the code executed or installed when the skill is used can differ from the code available during this audit. A compromised package, maintainer account, registry, or transitive dependency could introduce malicious initializer or lifecycle behavior. This finding represents supply-chain exposure; the audited files do not themselves contain a malicious payload.

Attack Path

  1. An attacker compromises a referenced package, one of its transitive dependencies, or the associated publication account.
  2. The attacker publishes a malicious release or modifies mutable distribution metadata.
  3. An agent follows the instructions in SKILL.md.
  4. The package manager resolves the attacker-controlled release because no exact audited version or integrity constraint is specified.
  5. Package initializer or lifecycle code executes with the permissions of the user running the command.
  6. The malicious dependency may alter the generated project or access resources available to that user.

Impact Assessment

Successful exploitation could permit arbitrary code execution under ...[truncated 457 chars]

Remediation
View remediation

Remediation Suggestions

  • Replace mutable package references such as @latest with exact, reviewed versions.
  • Pin direct dependencies to exact versions rather than ranges.
  • Generate, review, and commit package-manager lockfiles.
  • Use trusted registries and enforce package integrity verification.
  • Run dependency installation in an isolated, least-privileged environment without unnecessary secrets.
  • Disable package lifecycle scripts where feasible, or explicitly review every package requiring them.
  • Add automated dependency scanning and provenance checks to the handoff process.
  • Treat dependency upgrades as security-sensitive changes requiring review before updating pinned versions and lockfiles.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The invocation text is overly broad and includes generic terms like 'modern,' 'clean,' 'demos,' and 'MVPs,' which can cause the agent to trigger in situations beyond the author's intended scope. Over-broad activation increases the chance of inappropriate skill selection, potentially displacing safer or more specialized skills and leading to unintended file changes or actions in unrelated tasks.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The instruction 'Use this when the user hasn't provided explicit branding' is ambiguous because it does not define what counts as explicit branding or when this reference should not be applied. In practice, many ordinary requests could lack formal branding details, causing the skill to be invoked more broadly than intended.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The phrase 'when user only says "modern, clean, minimal"' relies on very common descriptive language that appears in many everyday design conversations. Without tighter scope or negative examples, this can cause unintended use of this design language snapshot for requests that merely mention generic aesthetic preferences.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
78% confidence
Finding

The skill instructs the agent to 'Default to Flutter unless user mandates another stack,' which biases technical decision-making without explicit user consent. While not directly a security exploit, it can override user expectations or environmental constraints and cause the agent to take unnecessary actions in a stack the user did not choose.

Content

No source excerpt is available for this finding.