ClawHub
Back to skill

Security audit

analytics-sdk-setup

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent Pixel setup and audit skill with conservative privacy guardrails, but users should pin install tooling and review tracking changes carefully.

Before installing, use a reviewed local copy or pin the `skills` CLI and repository source to an immutable version, and prefer project-scoped installation. Before enabling or changing tracking, confirm consent handling, CSP changes, LDU requirements, and whether any identifiers or Advanced Matching are explicitly approved.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
README.md:23
Finding

Unpinned Third-Party CLI and Mutable Repository Installation

Content
View full analysis

Vulnerability Details

File Location: README.md:23-57
Vulnerability Type: Unpinned third-party dependency execution and mutable remote installation source
Risk Level: Medium

Vulnerable Code

bash
npx skills add ./analytics-sdk-setup -a claude-code
bash
npx skills add Peter-WF/analytics-sdk-setup -a claude-code
bash
npx skills list -a claude-code
bash
npx skills add ./analytics-sdk-setup -g -a claude-code

Technical Analysis

The documented commands invoke the skills npm package through npx without specifying a reviewed version or enforcing an integrity constraint. If the package is absent locally, npx may retrieve and execute the currently resolved package version from the configured npm registry. The effective executable can therefore change after this project has been reviewed.

The GitHub-source installation command also identifies the Skill through a repository name without pinning it to an immutable commit. Changes to the repository's default branch can consequently alter the installed content. This is especially significant for an agent Skill because installed instructions may later influence coding-agent behavior and access to project files.

These commands are documentation examples and are not executed automatically by the project. Exploitation therefore requires a user or automation process to follow the installation instructions. The risk arises from trusting mutable third-party supply-chain components at execution and installation time.

Attack Path

  1. An attacker compromises the npm package, its publisher account, the configured registry, or the referenced GitHub repository.
  2. The attacker publishes a malicious package version or changes the repository's default-branch content.
  3. A user follows the README and runs an unpinned npx skills command.
  4. npx resolves and executes the attacker-controlled package version with the user's ...[truncated 999 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin the CLI to a reviewed, exact version:

    bash
    npx --yes skills@X.Y.Z list -a claude-code

    Replace X.Y.Z with a verified release and establish a controlled process for updating it.

  2. Prefer installing the CLI through a lockfile-controlled development dependency and invoking the locally installed binary:

    bash
    npm install --save-dev --save-exact skills@X.Y.Z
npx --no-install skills list -a claude-code

  3. Commit and review the package-manager lockfile. In automated environments, use reproducible installation commands such as npm ci.

  4. Pin repository-based Skill sources to an immutable commit SHA rather than a mutable default branch, if supported by the CLI. Otherwise, download and review a fixed archive before installing it from a local path.

  5. Verify package provenance, publisher identity, checksums, signatures, and registry configuration before execution. Document the expected package name and source to reduce dependency-confusion and registry-substitution risk.

  6. Prefer project-scoped installation. Clearly warn that global installation broadens the impact to other projects and should only be performed after reviewing the exact installed content.

  7. Run installation in a least-privileged environment without unnecessary credentials, sensitive environment variables, or write access beyond the intended project.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (26)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 16)May include surrounding context.

md
If the environment does not load `SKILL.md` directly and instead expects a single prompt block, use:

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 19)May include surrounding context.

md
If the environment does not load `SKILL.md` directly and instead expects a single prompt block, use:

Rp1

Medium
Category
MCP Rug Pull
Confidence
90% confidence
Finding

The README instructs users to run npx skills ... without pinning a specific package version. Because npx resolves the latest package by default, a future compromised or malicious release of the skills package could be executed during install or verification, creating a supply-chain execution risk on developer machines.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
90% confidence
Finding

This command again uses npx skills without a pinned version, which means users may execute whatever version is current at the time they run it. In a skill-install context, that is meaningful because the command fetches and runs tooling that can modify the local environment and install additional content.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
88% confidence
Finding

Even the verification step uses npx skills unpinned, which still causes package resolution and possible code execution from the registry. A user may treat a harmless-looking 'list' command as safe, but it remains part of the same supply-chain trust boundary.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
90% confidence
Finding

The global install example runs an unpinned npx command, increasing the blast radius because global installation affects multiple projects and future workflows. If the fetched CLI version is malicious or compromised, it may persist changes more broadly on the workstation.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
87% confidence
Finding

The validation flow repeats the same unpinned npx skills pattern. Repetition across the README increases the likelihood that users copy and execute a non-reproducible registry-fetched command without considering supply-chain implications.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
87% confidence
Finding

This final verification example also depends on the latest published skills package at runtime. In aggregate, the document normalizes executing unpinned remote tooling, which is a recognizable supply-chain weakness even if no malicious behavior is present in the skill itself.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
89% confidence
Finding

The README instructs users to run npx skills without pinning an exact package version. npx will fetch the latest published package at execution time, so a compromised maintainer account, malicious new release, or unexpected breaking update could cause unreviewed code to execute on the user's machine during installation.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
89% confidence
Finding

This command again uses npx skills with no version pin, and additionally pulls skill content from a remote GitHub source. That combination increases supply-chain risk because both the CLI package version and the fetched skill source may change over time, leading to execution of code or prompts that were not the ones originally reviewed.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
84% confidence
Finding

Using unpinned npx skills for verification still executes whatever version is current at the time of use. Even though this is a 'list' operation, it requires trusting downloaded package code, so a malicious or compromised release could run attacker-controlled logic locally.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
89% confidence
Finding

The global installation example relies on unpinned npx skills, which is especially sensitive because global installs affect multiple projects and may persist malicious content in a shared location. If the fetched package is tampered with, the compromise can have broader and longer-lived impact than a project-local action.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
84% confidence
Finding

This validation step still tells users to execute unpinned npx skills, inheriting the same supply-chain risk as the installation steps. Repetition in validation sections makes unsafe usage more likely because users may copy these commands directly without reviewing prior warnings.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
84% confidence
Finding

The final verification example again executes an unversioned package from the registry at runtime. In a security-focused skill, this is more concerning because users are likely to trust the documentation and may run the command in development environments with repository access, tokens, or other sensitive local state.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The description says to use the skill whenever a user wants a coding agent to 'audit, install, reconcile, align, or fix' Pixel code, which is a wide set of verbs without tight exclusion boundaries. Although Pixel context narrows it somewhat, the trigger remains broad enough that many ordinary analytics-repair requests could match unintentionally.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

This line directs activation whenever the 'real job' appears to be Pixel debugging or alignment, but leaves substantial room for agent interpretation. Without clearer boundaries or concrete exclusion cases, similar tracking, analytics, or privacy tasks could be routed here by mistake.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The activation section includes expansive triggers like reviewing consent constraints, auditing analytics correctness, and cleaning up ownership in a repo. These are not always uniquely specific to this skill and, without stronger narrowing conditions, may capture requests better handled by other analytics or privacy skills.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill repeatedly says it should activate whenever a request 'clearly needs' repo-aware Pixel inspection, repair, alignment, governance, or debugging, using broad criteria rather than narrowly bounded triggers. In an agent setting, this can cause over-triggering on adjacent analytics or marketing tasks, leading the agent to enter a more invasive repo-analysis workflow than the user intended and increasing the chance of unnecessary code changes or privacy-sensitive tracking recommendations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

This file mandates Chinese-language instructions throughout the skill prompt and does not indicate that the user can choose another language. Under the natural-language policy rule, forcing a specific language without user opt-in is a locale/language policy concern.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
75% confidence
Finding

This section embeds executable third-party loader code that fetches https://analytics.tiktok.com/i18n/pixel/events.js and immediately initializes tracking with ttq.load(...) and ttq.page(). In a skill used by coding agents to modify real repositories, providing ready-to-paste tracking bootstrap code is security-relevant because it can cause third-party data transmission and script execution without ensuring consent, CSP allowlisting, or organizational approval at the point of use.

Content

Scanner excerpt · references/install-and-events.md (reported line 44)May include surrounding context.

html
<script>
!function(w,d,t){w.TiktokAnalyticsObject=t;var ttq=w[t]=w[t]||[];ttq.methods=["page","track","identify","instances","debug","on","off","once","ready","alias","group","enableCookie","disableCookie"],ttq.setAndDefer=function(t,e){t[e]=function(){t.push([e].concat(Array.prototype.slice.call(arguments,0)))}};for(var i=0;i<ttq.methods.length;i++)ttq.setAndDefer(ttq,ttq.methods[i]);ttq.instance=function(t){for(var e=ttq._i[t]||[],n=0;n<ttq.methods.length;n++)ttq.setAndDefer(e,ttq.methods[n]);return e},ttq.load=function(e,n){var i="https://analytics.tiktok.com/i18n/pixel/events.js";ttq._i=ttq._i||{},ttq._i[e]=[],ttq._i[e]._v='analytics/0.0.1',ttq._i[e]._u=i,ttq._t=ttq._t||{},ttq._t[e]=+new Date,ttq._o=ttq._o||{},ttq._o[e]=n||{};var o=document.createElement("script");o.type="text/javascript",o.async=!0,o.src=i+"?sdkid="+e+"&lib="+t;var a=document.getElementsByTagName("script")[0];a.parentNode.insertBefore(o,a)};ttq.load('<PIXEL_ID>');ttq.page()}(window,document,'ttq');
</script>

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The file includes a ttq.identify(...) example with hashed email, phone number, and external ID, but this reference does not itself warn that these are privacy-sensitive identifiers subject to consent, hashing requirements, and jurisdiction-specific restrictions. In a skill specifically meant to guide implementation of tracking pixels, omission of nearby privacy guidance increases the chance an agent copies identity collection into a repo without proper gating or legal review.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/install-and-events.md (reported line 33)May include surrounding context.

md
根据 TikTok 的安装指南，base code 应该：
- 放在 **`<head>` section 顶部附近**
- 以**完整 JavaScript base code block** 形式粘贴，而不是部分片段
- 包含 `https://analytics.tiktok.com/i18n/pixel/events.js` 的 loader
- 调用 `ttq.load('<PIXEL_ID>')`
- 调用 `ttq.page()` 来发送基础 page-view 事件，供安装验证使用

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/install-and-events.zh-CN.md (reported line 33)May include surrounding context.

md
根据 TikTok 的安装指南，base code 应该：
- 放在 **`<head>` section 顶部附近**
- 以**完整 JavaScript base code block** 形式粘贴，而不是部分片段
- 包含 `https://analytics.tiktok.com/i18n/pixel/events.js` 的 loader
- 调用 `ttq.load('<PIXEL_ID>')`
- 调用 `ttq.page()` 来发送基础 page-view 事件，供安装验证使用

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/install-and-events.zh-CN.md (reported line 44)May include surrounding context.

md
根据 TikTok 的安装指南，base code 应该：
- 放在 **`<head>` section 顶部附近**
- 以**完整 JavaScript base code block** 形式粘贴，而不是部分片段
- 包含 `https://analytics.tiktok.com/i18n/pixel/events.js` 的 loader
- 调用 `ttq.load('<PIXEL_ID>')`
- 调用 `ttq.page()` 来发送基础 page-view 事件，供安装验证使用

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The document includes a concrete ttq.identify(...) example sending hashed email, phone number, and external ID to TikTok, but provides no adjacent warning about consent, lawful basis, notice, or regional privacy restrictions. In the context of an installation guide for real repositories, this omission can cause agents or developers to implement cross-site identity sharing by default, leading to privacy-law violations and unauthorized disclosure of personal data to a third party.

Content

No source excerpt is available for this finding.