ClawHub
Back to skill

Security audit

BimDown

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent BIM modeling helper with disclosed local file changes, an optional consent-gated publish flow, and a disclosed CLI install requirement.

Before installing, consider using a pinned or project-local bimdown-cli install if your environment requires stronger supply-chain control. Only approve publishing when the BIM project can be shared publicly by link, because the upload includes project files, geometry, room names, materials, notes, and any GLB meshes.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:12
Finding

Unpinned Global npm Dependency Permits Supply-Chain Code Execution

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 12–33
Vulnerability Type: Unpinned third-party dependency installed globally
Risk Level: Medium

Vulnerable Code

yaml
"bins": ["bimdown"],
"install": { "npm": "bimdown-cli" }
markdown
1. **Check first**: Run `which bimdown` (or `bimdown --version`). If it exists, skip the install step.
2. **If missing**: Install via npm — but you **MUST explicitly ask the user for permission** before running `npm install -g` autonomously. This writes to global npm paths and executes arbitrary package scripts, so it is a privileged action.

```bash
npm install -g bimdown-cli
text

### Technical Analysis

The Skill directs the agent to install the latest available release of `bimdown-cli` from npm without an exact version, lockfile, or integrity hash. Because npm dependencies and lifecycle scripts can execute code during installation, the effective code installed by this instruction may change after the Skill has been audited.

Requiring user permission appropriately acknowledges the privileged nature of the operation, but consent does not establish package integrity. If the package, its publisher account, or a transitive dependency is compromised, a malicious release can run under the privileges of the user performing the installation. The global installation scope also modifies shared executable paths rather than isolating the dependency within a project.

No evidence establishes that the current `bimdown-cli` package is malicious. The confirmed weakness is the mutable, unverified dependency installation process.

### Attack Path

1. An attacker compromises the npm publisher account, the package itself, or one of its installation-time dependencies.
2. The attacker publishes a malicious release under the existing `bimdown-cli` package name.
3. On a system where `bimdown` is absent, the Skill asks for installation permission as documented.
4. Aft
...[truncated 1033 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin bimdown-cli to an exact, reviewed version rather than resolving the mutable latest release:
    bash
    npm install --save-exact bimdown-cli@<reviewed-version>
  2. Prefer a project-local installation and invoke it through a controlled local path instead of modifying global executable locations.
  3. Commit and enforce a lockfile containing resolved transitive dependency versions and integrity metadata.
  4. Verify the package provenance, publisher identity, source repository, and registry integrity before installation.
  5. Where compatible with the package, disable npm lifecycle scripts during installation using --ignore-scripts; separately run only explicitly reviewed setup steps.
  6. Execute installation and CLI operations in a sandbox or least-privileged environment with access limited to the required project directory.
  7. Document a tested version upgrade process requiring security review before changing the pinned version or lockfile.
  8. Retain the existing explicit-consent requirement, but disclose the exact version, source, global or local installation scope, and lifecycle-script behavior in the consent request.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 133)May include surrounding context.

md
9. **`bimdown resolve-topology <dir>`**: Auto-detects coincident endpoints for MEP curves, generates `mep_nodes`, and fills connectivity fields.
10. **`bimdown merge <dirs...> -o <output>`**: Merges multiple project directories into one, resolving ID conflicts.
11. **`bimdown sync <dir>`**: Hydrates into DuckDB and dehydrates back out to CSV/SVG, applying computed defaults.
12. **Downloading a shared project**: If the user provides a share link like `https://bim-claw.com/s/<token>`, append `/download` to get the zip: `curl -L https://bim-claw.com/s/<token>/download -o project.zip && unzip project.zip -d project/`

## Publishing & Data Upload