ClawHub
Back to skill

Security audit

web-artifacts-builder

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent frontend artifact builder, but its setup uses mutable npm/pnpm downloads that users should run in an isolated project.

Run this only in a dedicated project directory or container, review the shell scripts first, and expect package-manager downloads and local file changes. Consider pinning dependency and CLI versions, avoiding the global pnpm install, and verifying the missing shadcn components tarball before relying on the init script.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
scripts/init-artifact.sh:36
Finding
Mutable and Unverified Package Dependencies Permit Supply-Chain Code Execution## Vulnerability Details **File Location**: `scripts/init-artifact.sh:36`, `scripts/init-artifact.sh:59`, `scripts/init-artifact.sh:69-79`, `scripts/init-artifact.sh:272-273`, `scripts/bundle-artifact.sh:21`, `SKILL.md:94`, and `SKILL.md:109` **Vulnerability Type**: Unpinned third-party dependency retrieval and execution **Risk Level**: Medium ### Vulnerable Code `scripts/init-artifact.sh:36`: ```bash npm install -g pnpm ``` `scripts/init-artifact.sh:59`: ```bash pnpm create vite "$PROJECT_NAME" --template react-ts ``` `scripts/init-artifact.sh:69-79`: ```bash pnpm install # Pin Vite version for Node 18 if [ "$NODE_VERSION" -lt 20 ]; then echo "📌 Pinning Vite to $VITE_VERSION for Node 18 compatibility..." pnpm add -D vite@$VITE_VERSION fi echo "📦 Installing Tailwind CSS and dependencies..." pnpm install -D tailwindcss@3.4.1 postcss autoprefixer @types/node tailwindcss-animate pnpm install class-variance-authority clsx tailwind-merge lucide-react next-themes ``` `scripts/init-artifact.sh:272-273`: ```bash pnpm install @radix-ui/react-accordion @radix-ui/react-aspect-ratio @radix-ui/react-avatar @radix-ui/react-checkbox @radix-ui/react-collapsible @radix-ui/react-context-menu @radix-ui/react-dialog @radix-ui/react-dropdown-menu @radix-ui/react-hover-card @radix-ui/react-label @radix-ui/react-menubar @radix-ui/react-navigation-menu @radix-ui/react-popover @radix-ui/react-progress @radix-ui/react-radio-group @radix-ui/react-scroll-area @radix-ui/react-select @radix-ui/react-separator @radix-ui/react-slider @radix-ui/react-slot @radix-ui/react-switch @radix-ui/react-tabs @radix-ui/react-toast @radix-ui/react-toggle @radix-ui/react-toggle-group @radix-ui/react-tooltip pnpm install sonner cmdk vaul embla-carousel-react react-day-picker react-resizable-panels date-fns react-hook-form @hookform/resolvers zod ``` `scripts/bundle-artifact.sh:21`: ```bash pnpm add -D parcel @parcel/config-def ...[truncated 2660 chars]
Remediation
## Remediation Suggestions 1. Pin every direct dependency and executable CLI to an exact reviewed version. Remove `latest` and avoid unspecified versions or broad semver ranges. 2. Commit a reviewed `pnpm-lock.yaml` for the dependency set used by the scripts. 3. Install dependencies using immutable resolution, such as: ```bash pnpm install --frozen-lockfile ``` 4. Replace mutable scaffolding execution with an exact package version, for example: ```bash pnpm dlx create-vite@REVIEWED_VERSION "$PROJECT_NAME" --template react-ts ``` 5. Pin `pnpm`, Parcel, `html-inline`, `parcel-resolver-tspaths`, shadcn tooling, and all runtime and development dependencies. 6. Avoid automatically installing a global package. Require a documented, verified package-manager version or use Corepack with a pinned `packageManager` declaration. 7. Disable dependency lifecycle scripts where they are unnecessary, and explicitly review packages that require installation scripts. 8. Verify package provenance and integrity through registry signatures, checksums, trusted internal mirrors, or an allowlisted dependency proxy. 9. Run installation and build operations in an isolated, non-privileged container with minimal filesystem access and no sensitive credentials. 10. Add automated dependency scanning and lockfile-diff review to detect unexpected package, integrity, or transitive dependency changes.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Hidden Instructions

High
Category
Prompt Injection
Content
---
name: web-artifacts-builder
version: 1.0.0
description: "Build elaborate multi-component HTML artifacts using React, Tailwind CSS, and shadcn/ui"
Confidence
60% confidence
Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding
The skill tells users to run `npx shadcn-ui@latest add <component>`, which fetches and executes remote package code at runtime without a pinned version. That creates a supply-chain risk: a compromised or newly introduced malicious release could execute arbitrary code on the user's system during scaffolding.

Missing User Warnings

Low
Confidence
87% confidence
Finding
The skill instructs users to run initialization and bundling scripts that create and modify project files, install dependencies, and generate configuration, but it does not clearly warn about the extent of those local changes. While this is not inherently malicious, it can lead to unintended filesystem modification, dependency installation, or overwriting files if users run the commands in the wrong directory or without understanding the side effects.

Static analysis

No suspicious patterns detected.