ClawHub
Back to skill

Security audit

Yida App

Security checks for vulnerabilities and agentic risk

Overview

The skill fits its Yida app-building purpose, but it can install unaudited dependencies and publish changes to a live Yida app using stored login cookies without a clear final approval step.

Install only if you are comfortable giving the agent access to a Yida login session that can create and modify applications. Review the referenced sub-skills, especially yida-publish-page, require an explicit confirmation before publishing, and avoid running this against production apps until dependencies and target identifiers are verified.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:280
Finding

Unverifiable and Unpinned npm Dependency Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 280–285
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code

bash
cd .claude/skills/yida-publish-page/scripts
npm install  # First-time dependency installation
node publish.js <appType> <formUuid> <source-file-path>

Technical Analysis

The skill instructs the agent to execute npm install in the directory of a separately referenced publishing sub-skill. The audited project contains only SKILL.md; it does not include the referenced directory, a package.json, or a dependency lockfile. Consequently, the dependency names, resolved versions, integrity hashes, package sources, and lifecycle scripts cannot be verified within the audited artifact.

Running npm install can download third-party packages and execute their lifecycle scripts, including preinstall, install, and postinstall. If the external publishing sub-skill uses unpinned or compromised dependencies, installation could execute arbitrary code under the privileges of the agent process. This is a supply-chain exposure rather than evidence that a particular dependency is currently malicious.

Attack Path

  1. An attacker compromises a dependency or dependency version referenced by the external yida-publish-page sub-skill, or causes an unsafe dependency to resolve through dependency confusion or an unpinned version range.
  2. The agent follows the instructions in SKILL.md and changes into the publishing script directory.
  3. The agent runs npm install.
  4. npm retrieves the attacker-controlled package and executes a malicious lifecycle script.
  5. The script runs with the agent's local privileges and can attempt to read project files, authentication state, source code, or modify the publishing workflow.
  6. The compromised workflow may subsequently deploy attacker-modified content to the authenticated YiDA application.

...[truncated 618 chars]

Remediation
View remediation

Remediation Suggestions

  1. Include the complete yida-publish-page sub-skill and its dependency manifest in the auditable project.
  2. Commit a lockfile containing resolved versions and integrity hashes, and use npm ci instead of npm install for reproducible installation.
  3. Pin all direct dependencies to reviewed versions and validate transitive dependencies with software-composition analysis.
  4. Use npm ci --ignore-scripts when lifecycle scripts are unnecessary. If scripts are required, document and audit every script before execution.
  5. Configure npm to use an approved registry and apply package allowlisting or provenance verification where available.
  6. Run installation and publishing in a sandbox with minimal filesystem and network access. Do not expose .cache/cookies.json to dependency installation processes unless strictly necessary.
  7. Separate dependency installation from authenticated publishing so that third-party installation code cannot access active YiDA session material.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The manifest description and heading/body content require Chinese comprehension, which effectively forces a specific language for use of the skill. The file does not indicate that the skill is intentionally limited to Chinese-speaking users or provide any opt-in/alternative language behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill instructs the agent to compile and publish code directly to the Yida platform, modifying a remote application, but does not require an explicit confirmation or warning that this action affects a live system. In an agentic context, this increases the risk of unintended deployment, overwriting production state, or making irreversible changes without informed user consent.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.