ClawHub
Back to skill

Security audit

Chat Ui

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward chat UI component guide, with the main risk being unpinned remote install commands users should review before running.

Before installing, review the remote shadcn registry output and related skills, prefer pinned versions or reviewed commits when possible, and run installation from a least-privileged development environment without production secrets.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:15
Finding

Unpinned Third-Party Code and Skill Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:15-18 and SKILL.md:108-118
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

The Skill recommends executing mutable npm package versions and installing components or related Skills from remote sources without version pins, immutable commit references, integrity hashes, or signature verification.

Relevant code from SKILL.md:15-18:

bash
# Install chat components
npx shadcn@latest add https://ui.inference.sh/r/chat.json

Relevant code from SKILL.md:108-118:

bash
# Full agent component (recommended)
npx skills add inference-sh/skills@agent-ui

# Declarative widgets
npx skills add inference-sh/skills@widgets-ui

# Markdown rendering
npx skills add inference-sh/skills@markdown-ui

Technical Analysis

The npx shadcn@latest command resolves and executes a mutable package version. The remote registry URL also supplies component definitions whose contents can change independently after this Skill has been reviewed. The related npx skills add commands similarly use an unpinned command-line package and mutable Skill references.

Because no exact package versions, immutable source revisions, checksums, or signatures are specified, the code ultimately executed or installed may differ from the code originally intended by the Skill author. A compromise of the npm package, remote component registry, associated repository, publisher account, or distribution infrastructure could therefore turn these documented installation commands into a supply-chain delivery mechanism.

No evidence establishes that the currently referenced resources are malicious. The vulnerability is the unsafe reliance on mutable and unverified third-party content.

Attack Path

  1. An attacker compromises an upstream npm publisher, remote registry, referenced Skill repository, or its distribution infrastructure.
  2. The attacker publishes ...[truncated 1326 chars]
Remediation
View remediation

Remediation Suggestions

  1. Replace shadcn@latest with an exact, reviewed package version and enforce that version through the package lockfile.
  2. Pin each related Skill to an immutable release or commit hash rather than a mutable repository reference.
  3. Download and review remote registry manifests and all generated files before adding them to the project.
  4. Verify downloaded artifacts using trusted checksums or cryptographic signatures where supported.
  5. Review npm lifecycle scripts and use installation controls that prevent unnecessary script execution.
  6. Run installation commands in an isolated, least-privileged environment without production credentials or sensitive developer tokens.
  7. Record approved artifact hashes and periodically audit upstream changes before upgrading.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The trigger list contains very broad phrases such as chat ui, chat component, chat interface, and messaging ui, which are likely to match many ordinary user requests. Overbroad triggers can cause the skill to activate in unintended contexts, increasing the chance of inappropriate tool selection, prompt-surface expansion, or accidental execution paths.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The skill instructs users to run npx shadcn@latest add ..., which pulls and executes a remote package version that is not pinned to a specific immutable release. If the upstream package is compromised or a breaking/malicious update is published, users of this skill could execute unreviewed code during installation.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
92% confidence
Finding

The documented npx skills add inference-sh/skills@agent-ui command relies on resolving and executing an unpinned package reference at runtime. This creates a supply-chain risk because future upstream changes or compromise could alter what code is fetched and run for users following the documentation.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
92% confidence
Finding

The npx skills add inference-sh/skills@widgets-ui example points users to install a remote skill reference without a pinned version. Because the resolved artifact can change over time, this exposes consumers to supply-chain compromise or unexpected behavior if the upstream source is modified.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
92% confidence
Finding

The npx skills add inference-sh/skills@markdown-ui command references a non-immutable remote package target. Users who run this later may receive different code than originally intended, which is dangerous if the package or distribution channel is compromised.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.