ClawHub
Back to skill

Security audit

Research Planner

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent research-planning template skill, with practical cautions around verified installation and proper participant privacy/consent handling.

Install from ClawHub or a pinned, reviewed commit rather than running an unpinned npx command against a mutable main branch. When using the generated research materials, treat consent/privacy language as a draft: confirm recording consent, data types, storage, access, retention, deletion, third-party tools, and local legal/compliance requirements before contacting participants or collecting recordings/screenshots. Use dedicated test accounts instead of real credentials when reviewing products.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:12
Finding

Unpinned Third-Party Installer and Mutable Repository Source

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 12–14
Vulnerability Type: Supply-chain risk from unpinned executable dependencies and mutable remote content
Risk Level: Medium

Vulnerable Code

markdown
**Manual Installation:**
```bash
npx skills add https://github.com/NKZ55/research-planner/tree/main/skills/research-planner
text

### Technical Analysis

The documented manual installation procedure invokes the `skills` npm package through `npx` without specifying an exact package version. It also installs Skill content from the mutable `main` branch of a GitHub repository rather than from a verified commit or immutable release.

Running `npx` can download and execute package code during installation. Because neither the npm package version nor the repository revision is pinned, the effective installation behavior and installed content can change after this version of the Skill has been reviewed. A compromise or malicious update affecting either upstream source could therefore expose users to code or instructions that were not included in the audited artifact.

The audit did not establish that either current upstream source is malicious. The vulnerability is the absence of dependency immutability and integrity verification.

### Attack Path

1. An attacker compromises the npm package, its maintainer account, the GitHub repository, or an associated publishing credential.
2. The attacker publishes a modified `skills` package version or changes content on the repository's `main` branch.
3. A user follows the documented manual installation command.
4. `npx` resolves and executes the currently available package rather than a known audited version.
5. The installer retrieves the repository's current branch content rather than a verified revision.
6. Attacker-controlled installation code or Skill instructions are executed or installed in the user's environment.

### Impact Assessment

Successful exploitation could execute code with the p
...[truncated 680 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin the skills npm package to an exact, reviewed version rather than allowing npx to resolve the latest release:
    bash
    npx --yes skills@<audited-exact-version> add ...
  2. Replace the mutable main branch URL with an immutable, reviewed Git commit or signed release tag.
  3. Publish and verify cryptographic hashes or signatures for the expected Skill package.
  4. Use a lockfile or an equivalent dependency manifest where the installation mechanism supports it.
  5. Prefer a trusted, versioned package registry or a locally reviewed installer over direct installation from a mutable personal repository.
  6. Document the expected package version, repository commit, and integrity value so users can verify them before installation.
  7. Run installation with least privilege in an isolated environment, and do not expose unrelated credentials or sensitive environment variables to the installer.
  8. Establish a release process that reviews dependency and repository changes before updating the documented installation command.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (12)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 413)May include surrounding context.

md
To keep `SKILL.md` concise, move heavier content into separate files when needed:

Context Leakage

High
Category
Data Exfiltration
Confidence
85% confidence
Finding

Code or instructions that leak agent conversation context to external services, potentially exposing sensitive user interactions.

Content

Scanner excerpt · templates/usability-test-script-template.md (reported line 46)May include surrounding context.

md
Today, we’re going to look at [product / prototype] and see how easy or difficult it is to use for tasks like [high‑level tasks]. We’re testing the product, **not** you. There are no right or wrong answers.

**Recording**
With your permission, we’ll record the session so our team can review it later. The recording will only be used internally for research.

**Think‑aloud**
It’s very helpful if you can think aloud—tell me what you’re trying to do, what you expect to happen, and anything that is confusing or surprising.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The invocation description is broad enough to trigger on many generic planning or structuring requests, which can cause the agent to select this skill in situations outside its intended niche. Over-broad routing increases the chance of inappropriate context capture, unintended prompt takeover of unrelated tasks, or suppression of better-suited skills, especially in systems that auto-select skills from descriptions.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The template explicitly prompts collection of recordings, observations, and notable quotes, but it does not clearly require informed participant consent, privacy handling, data minimization, or rules for storing/sharing sensitive field notes. In a contextual inquiry setting, researchers often observe people in workplaces or homes and may capture confidential business information or personal data incidentally, so omission of privacy guidance can lead to unauthorized collection or mishandling of sensitive information.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The template explicitly prompts for audio/video recording and mentions consent, but it does not instruct the user to define how recordings will be stored, who can access them, how long they will be retained, or how participant-identifiable information will be protected. In a research-planning skill, this omission can lead users to create study plans that collect sensitive participant data without adequate privacy safeguards, increasing compliance and confidentiality risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The template mentions recording the session 'with your permission' but does not explicitly require the moderator to obtain and document affirmative consent before recording begins. In a research-planning skill, this omission can lead users to start recording without a clear consent step, creating privacy, legal, and compliance risk for participants.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The template encourages collection of screening responses and demographic or firmographic data while only providing a broad confidentiality statement, without prompting authors to disclose specific data uses, retention, sharing, legal basis, or participant rights. In a research-planning skill, this can lead downstream users to create participant-facing materials that under-inform respondents, increasing privacy, consent, and compliance risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
78% confidence
Finding

This markdown template includes concrete guidance for distributing surveys via email, in-product prompts, SMS, and support follow-up, but it does not warn users to consider privacy, consent, or data-handling implications. Because the file is a markdown template that could influence user-data collection behavior, a brief disclosure would help prevent unintentional privacy-impacting use.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The template encourages collection of screenshots/photos and use of channels like SMS or messaging apps, but it does not instruct researchers to avoid sensitive data capture, obtain informed consent, or use approved secure storage/transport. In a research-planning skill, that omission can lead users to design studies that unnecessarily collect personal or confidential information through insecure channels, creating privacy and compliance risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
92% confidence
Finding

The template explicitly mentions collecting photos, documents, tools, and other participant artifacts, but the privacy protections are only implied elsewhere and not tied directly to this sensitive collection activity. In a research-planning skill, that omission can lead users to draft studies that gather identifiable or sensitive materials without adequate consent, minimization, or handling safeguards.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The template instructs moderators to obtain permission for recording, but it provides only a vague statement that recordings are for internal research and omits basic data-handling details such as storage, access, retention, and participant rights. In a research workflow, this can lead to under-informed consent, privacy complaints, or noncompliance with organizational or legal requirements if moderators use the template as-is.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.