ClawHub
Back to skill

Security audit

Widgets Ui

Security checks for vulnerabilities and agentic risk

Overview

This widget UI skill is coherent, but it asks users to install mutable remote packages and related skills without version pins, so users should review it before use.

Install only after reviewing the fetched component code and any related skills. Prefer pinned package versions, immutable commit hashes, or checksums, and run installation in a low-privilege development environment without unnecessary secrets in the environment.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:14
Finding

Unpinned Third-Party Package and Remote Component Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 14-16
Vulnerability Type: Unpinned third-party dependency and mutable remote component installation
Risk Level: Medium

Vulnerable Code

bash
npx shadcn@latest add https://ui.inference.sh/r/widgets.json

Technical Analysis

The documented command invokes npx with the mutable shadcn@latest package tag and retrieves component definitions from an external URL. npx can download and execute a package when the requested version is not already available locally. The latest tag does not identify an immutable, previously audited release.

The component registry URL is also mutable and is not accompanied by a cryptographic checksum, signed release, fixed commit identifier, or other integrity control. Consequently, the code installed by this command can differ from the code reviewed when the Skill was published.

This is a supply-chain weakness rather than evidence that the current upstream package or component is malicious. Exploitation requires compromise or malicious modification of the package, package-publishing account, registry service, DNS or delivery infrastructure, or another trusted upstream source.

Attack Path

  1. An attacker compromises an upstream package publisher, the remote component registry, or its delivery infrastructure.
  2. The attacker publishes a malicious package as the version referenced by latest, or modifies the response returned by https://ui.inference.sh/r/widgets.json.
  3. A user follows the Skill documentation and executes the command.
  4. npx downloads and runs the mutable package, which then retrieves and installs the remote component.
  5. Attacker-controlled installation logic or generated source code executes immediately or later during development, build, or application runtime.

Impact Assessment

Successful exploitation could execute code with the privileges of the developer running npx. Depending on that account's access and the ...[truncated 513 chars]

Remediation
View remediation

Remediation Suggestions

  • Replace shadcn@latest with an exact, reviewed package version.
  • Pin the remote component to an immutable, versioned artifact rather than a mutable registry endpoint.
  • Publish and verify a SHA-256 or stronger cryptographic checksum before integrating downloaded content.
  • Prefer signed releases and verify package provenance or signatures where supported.
  • Download and review generated component code before executing builds or committing it to the project.
  • Use lockfiles, trusted package registries, and restricted installation environments.
  • Run installation with a minimally privileged account and without unnecessary credentials in the environment.
  • Add dependency and generated-code scanning to CI before release.

T08 · Insecure Dependencies

Warning
Location
SKILL.md:145
Finding

Unpinned Installation of Related Skills from an External Repository

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 145-153
Vulnerability Type: Unpinned external Skill dependencies
Risk Level: Medium

Vulnerable Code

bash
# Full agent component
npx skills add inference-sh/skills@agent-ui

# Chat UI blocks
npx skills add inference-sh/skills@chat-ui

# Tool UI
npx skills add inference-sh/skills@tools-ui

Technical Analysis

These commands invoke the skills package through npx and install three externally maintained Skills without specifying an immutable package version, repository commit, release digest, or checksum. Both the command runner and the referenced Skill content may therefore change after this project has been audited.

If the package publisher, referenced repository, distribution channel, or maintainer account is compromised, a subsequent installation may retrieve different instructions, scripts, or components. Because Skills can influence agent behavior and may include executable supporting content, reviewing only the current SKILL.md does not establish the safety of future content fetched by these commands.

No evidence in the audited file demonstrates that the currently referenced Skills are malicious. The risk arises from the absence of version and integrity controls.

Attack Path

  1. An attacker gains control of the skills package distribution channel, the inference-sh/skills repository, a maintainer account, or associated delivery infrastructure.
  2. The attacker modifies one of the referenced Skill targets or substitutes a malicious release.
  3. A user executes one of the documented npx skills add commands.
  4. The command retrieves the current, unpinned external content rather than a fixed audited revision.
  5. The malicious Skill content is installed and may affect agent instructions or execute supporting code when subsequently loaded or invoked.

Impact Assessment

Successful exploitation could modify the local project or Skill installation and introduce ...[truncated 599 chars]

Remediation
View remediation

Remediation Suggestions

  • Pin every related Skill to a reviewed, immutable commit hash or signed release.
  • Pin the skills command-line package to an exact version instead of allowing npx to resolve a mutable version.
  • Record and verify checksums for downloaded Skill artifacts.
  • Review external Skill instructions and all included scripts before installation or activation.
  • Maintain an approved internal mirror or vendored copy of reviewed dependencies.
  • Use lockfiles and automated provenance, signature, dependency, and malware checks in CI.
  • Install external Skills in a sandbox with minimal filesystem, network, credential, and tool access.
  • Establish an update process requiring security review before changing pinned revisions.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger list is broad and includes generic phrases such as widgets, dynamic ui, and structured output ui, which are likely to match many ordinary user requests. Over-broad activation increases the chance this skill is invoked unintentionally, causing unexpected remote-install guidance or UI-generation behavior in contexts where it was not specifically requested.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
92% confidence
Finding

The skill instructs users to run npx shadcn@latest add https://ui.inference.sh/r/widgets.json, which pulls and executes remote package logic and remote registry content without pinning to a specific immutable version. If the package, tag, or remote registry content changes or is compromised, users could install altered code or templates unexpectedly, creating a supply-chain risk.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
85% confidence
Finding

The command npx skills add inference-sh/skills@agent-ui references a remotely resolved package/resource without an immutable version pin. This allows future upstream changes or compromise of the referenced package/tag to affect consumers at install time, which is a classic supply-chain exposure.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
85% confidence
Finding

The npx skills add inference-sh/skills@chat-ui command uses an unpinned remote reference, so consumers may fetch different content over time. An attacker controlling or compromising the upstream source could deliver modified skill content or code to downstream users.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
85% confidence
Finding

The npx skills add inference-sh/skills@tools-ui instruction pulls a remote skill reference without pinning it to a stable immutable version. That makes builds non-reproducible and exposes users to upstream tampering or accidental breaking changes.

Content

No source excerpt is available for this finding.