ClawHub
Back to skill

Security audit

oia-skill

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it claims: installs an oia project helper and guides an agent through creating and verifying a Deno/Fresh project, with some normal but important package-installation risks.

Install only if you trust the @oia-ai packages and are comfortable with npx fetching code from npm. Prefer a scoped project install over --global unless you want this skill available everywhere, and avoid running the curl-to-shell Deno installer blindly; use a trusted package manager or inspect the official installer first.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Tp4

High
Category
MCP Tool Poisoning
Confidence
90% confidence
Finding
The skill metadata and body claim the purpose is to initialize an oia/Deno/Fresh project, but the content also advertises installing the skill itself via npm into project or user skill directories, including a global mode that writes into the user's home directory. This mismatch is dangerous because it can cause the agent or user to authorize filesystem modifications outside the expected project scaffolding scope, undermining informed consent and making supply-chain or persistence behavior easier to hide.

Missing User Warnings

Medium
Confidence
84% confidence
Finding
The README explicitly states that the skill will run project scaffolding and start a development server, but it does not clearly warn users that invoking the skill will execute commands and modify the filesystem. In an agent-skill context, hidden or under-disclosed command execution increases the risk of unintended writes, dependency installation, and local service exposure, especially if users trigger the skill from natural-language prompts without realizing the side effects.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The skill instructs network operations (npm access, optional proxy use, polling a local web server) and file writes/overwrites during scaffolding, but does not prominently warn the user about these side effects before execution. In an agent context, this increases the risk of unexpected downloads, package execution, and modifications to existing directories, especially when `init .` may overwrite template files in the current folder.

External Script Fetching

High
Category
Supply Chain
Content
- `deno --version`：要求 Deno 2.x。未安装时引导安装：
  - Windows：`winget install Denoland.Deno`
  - macOS / Linux：`curl -fsSL https://deno.land/install.sh | sh`
- `npx --version`：确认 Node / npx 可用（仅用于执行 init 脚本，项目运行不依赖 Node）。

### 2. 生成脚手架
Confidence
97% confidence
Finding
The instruction `curl -fsSL https://deno.land/install.sh | sh` downloads and immediately executes a remote script without verification. This is dangerous because any compromise of the remote host, network path, or fetched script content can result in arbitrary code execution on the user's machine during environment setup.

Static analysis

No suspicious patterns detected.