T08 · Insecure Dependencies
Error
- Location
claw.json:18- Finding
Unpinned External Dependencies Execute Security-Critical Code
- Content
View full analysis
- Remediation
View remediation
Security audit
Neckr0ik Security Suite
Security checks for vulnerabilities and agentic risk
Overview
This security-suite skill is not clearly malicious, but it needs review because it can modify user files, relies on unpinned external scanner/fixer code, and may overstate compliance certification results.
Install only if you are comfortable running unpinned third-party scanner/fixer code on the target skill directory. Use scan and dry-run first, review diffs before applying fixes, avoid relying on generated certificates as real SOC 2, HIPAA, PCI-DSS, or GDPR compliance proof, and avoid writing reports over important existing files.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
other
Warning
- Location
scripts/suite.py:137- Finding
Compliance Certificates Can Be Issued Without Affirmative Control Validation
- Content
View full analysis
ComplianceResult: """Check compliance against a framework.""" framework_info = FRAMEWORKS.get(framework, FRAMEWORKS[Framework.SOC2]) controls = {ctrl: True for ctrl in framework_info["controls"]} findings = [] for vuln in vulnerabilities: # Map vulnerability to controls for prefix, affected_controls in framework_info["mappings"].items(): if vuln.id.startswith(prefix): for ctrl in affected_controls: if ctrl in controls: controls[ctrl] = False findings.append({ "control": ctrl, "control_name": framework_info["controls"][ctrl], "vulnerability": vuln.id, "severity": vuln.severity.value, "description": vuln.description, "file": vuln.file, "line": vuln.line, }) # Overall compliance compliant = all(controls.values()) return ComplianceResult( framework=framework, compliant=compliant, controls=controls, findings=findings, certificate_id=generate_certificate_id() if compliant else "NOT-COMPLIANT", timestamp=datetime.now().isoformat(), ) ``` ### Technical Analysis Every framework control is initialized to `True`. A control fails only when the external scanner returns a vulnerability whose identifier begins with one of a limited set of recognized prefixes. The absence of a recognized finding is ther ...[truncated 1825 chars]- Remediation
View remediation
Vulnerability Patterns
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (9)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
The documentation claims a complete security and compliance suite, but the described behavior extends beyond the declared description and references supporting components not present in this file. Security tooling that overstates coverage or certification capability can create false assurance, causing users to trust scans, fixes, or compliance outputs that may be incomplete or unsupported.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 83% confidence
- Finding
The skill advertises capabilities that read and modify user files, but it does not declare any explicit tool scope such as permissions or allowed-tools. That makes the operational boundary unclear and can lead to over-broad execution in environments that rely on manifest-declared permissions for policy enforcement and user trust.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The skill describes auto-fix behavior that rewrites files and can apply all fixes automatically, but it does not prominently warn users that their files may be modified. In a security tool, silent or insufficiently disclosed mutation of source trees can cause data loss, unsafe changes, or unwanted bulk edits to sensitive code and configuration.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The quick-start examples prominently include automatic remediation commands such as '--auto' without any adjacent caution about backups, destructive edits, or review before applying changes. Users commonly copy-paste quick-start commands, so unsafe examples materially increase the chance of accidental modification of production or sensitive files.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The module and CLI present framework-specific reporting and certification, implying certificate metadata should correspond to the selected framework. However, generate_certificate_id hardcodes a SOC2 prefix for every certificate, which contradicts the framework-specific certification behavior implemented elsewhere.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
The fix command invokes scan-and-fix and apply_fixes, which are file-modifying operations, but this file provides only terse command help and progress messages after execution starts. There is no clear user-facing warning in code comments, docstrings, or prompts here that running fix/--auto will change files, which is a safety-relevant operation for a general security suite.
- Content
Description-Behavior Mismatch
Low
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The manifest description enumerates scanner, fixer, and compliance reports for SOC2, HIPAA, and PCI-DSS. The code expands that advertised scope by defining a GDPR framework and exposing it through both the report and certify CLI commands, so the implemented behavior does not match the stated description.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The code writes report content to a user-supplied path using Path.write_text, and a similar write occurs for certificates. Although writing output files is part of the command purpose, this file does not disclose overwrite behavior or emit a confirmation when saving to an existing path.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The certify command saves generated certificate text to a caller-provided path with Path.write_text. This is a file-write operation with no explicit overwrite warning or confirmation in this file, which may surprise users if the target file already exists.
- Content