ClawHub
Back to skill

Security audit

Agent Ui

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent React/Next.js agent UI integration guide, with supply-chain and browser-automation cautions but no evidence of hidden or malicious behavior.

Review and pin package/component versions before running the install commands, inspect generated files before committing them, keep the API key in a secret-managed environment, and only enable client-side tools or form filling with clear user consent and narrow page/form scope.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:14
Finding

Unpinned and Mutable Third-Party Dependencies

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 14-20
Vulnerability Type: Unpinned third-party packages and remotely hosted component code
Risk Level: Medium

bash
# Install the agent component
npx shadcn@latest add https://ui.inference.sh/r/agent.json

# Add the SDK for the proxy route
npm install @inferencesh/sdk

Technical Analysis

The documented installation process retrieves and executes third-party content without pinning it to immutable, reviewed versions.

npx shadcn@latest resolves the current package release at execution time. The command then imports a component definition from the mutable remote URL https://ui.inference.sh/r/agent.json. Consequently, the installed component may differ from the content available when this skill was audited.

The npm install @inferencesh/sdk command also omits an exact package version. Package installation may execute dependency lifecycle scripts and place third-party code into the application. Without an exact version, lockfile enforcement, or integrity validation, upstream compromise or unexpected package changes could introduce unauthorized code.

No evidence establishes that the referenced packages or remote component are currently malicious. The vulnerability is the unsafe, mutable dependency acquisition process and the resulting supply-chain exposure.

Attack Path

  1. An attacker compromises the npm package, a transitive dependency, the package publishing account, or the remote component registry.
  2. The attacker publishes a modified release or changes the content returned by the component URL.
  3. A developer follows the Quick Start instructions after the compromise.
  4. npx downloads and executes the currently resolved shadcn package, while the component command retrieves mutable remote content.
  5. npm install resolves the current SDK dependency graph and may execute package lifecycle scripts.
  6. Attacker-controlled code m ...[truncated 866 chars]
Remediation
View remediation

Remediation Suggestions

  1. Replace shadcn@latest with a reviewed, exact version.
  2. Pin @inferencesh/sdk to an exact version rather than relying on the newest compatible release.
  3. Commit and enforce a package lockfile using reproducible installation commands such as npm ci.
  4. Reference the remote component through an immutable, versioned artifact or commit rather than a mutable URL.
  5. Verify downloaded artifacts using trusted checksums, signatures, or package integrity metadata.
  6. Review the remote manifest and all generated source files before building or executing them.
  7. Audit direct and transitive dependencies with package security tooling and dependency-review controls.
  8. Disable package lifecycle scripts where operationally possible, or perform installation inside an isolated, least-privileged environment.
  9. Restrict CI credentials, filesystem access, and outbound network access during dependency installation.
  10. Establish an approved dependency update process so new versions are reviewed and tested before adoption.

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (7)

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 35)May include surrounding context.

2. Environment Variable

bash
# .env.local
INFERENCE_API_KEY=inf_...

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The trigger list includes broad phrases such as 'ai assistant ui' and 'react agent', which may match ordinary user intent too loosely and cause unintended invocation of this skill. Because the skill enables agent runtime, client-side tools, and form-filling behavior, accidental activation increases the chance of unsafe automation in inappropriate contexts.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The description advertises client-side tools, human-in-the-loop flows, and form filling, but does not warn that these features can affect browser state, page content, or user data. In this context, omission is significant because users may enable powerful UI automation without understanding privacy, consent, or integrity implications.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
87% confidence
Finding

The skill instructs users to run npx shadcn@latest add ..., which fetches and executes remote package code at the latest version rather than a pinned, audited release. If the upstream package or its dependencies are compromised, users could execute attacker-controlled code during setup.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
82% confidence
Finding

The npx skills add inference-sh/skills@chat-ui command references a remote package/skill without an immutable version pin. This creates a supply-chain risk because future changes or a compromise of the referenced package could alter what users install or execute.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
82% confidence
Finding

The npx skills add inference-sh/skills@widgets-ui command uses an unpinned remote reference, allowing the installed content to change over time. In an agent-skill ecosystem, that can lead to silent introduction of malicious or unsafe behavior into downstream environments.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
82% confidence
Finding

The npx skills add inference-sh/skills@tools-ui installation example relies on a non-immutable remote reference. Because npx may download and run current package contents, users are exposed to supply-chain compromise if the source changes or is hijacked.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.