ClawHub
Back to skill

Security audit

PigBun RedNote

Security checks for vulnerabilities and agentic risk

Overview

This RedNote automation skill is clearly described, but it can publish, edit, delete, comment, follow, and use an account session without documenting safeguards.

Review this before installing if you connect a real RedNote account. Only use it where you are comfortable letting an agent perform visible social actions, and require explicit confirmation for publish, edit, delete, comment, follow, like, and collect actions. Store the PigBun API key as a secret and prefer a pinned Playwright installation flow.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:12
Finding

Unpinned Playwright Package Execution Through npx

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:12
Vulnerability Type: Unpinned third-party package execution
Risk Level: Medium

Vulnerable code:

sh
npx playwright install chromium

Technical Analysis

The setup documentation directs users to execute Playwright through npx without declaring or pinning an exact package version. If Playwright is not already installed locally, npx may resolve and execute package code obtained from the configured package registry. The reviewed project provides no dependency manifest, lockfile, integrity metadata, or package provenance policy that would constrain this resolution.

Consequently, the code executed during installation may differ between invocations and cannot be tied to the version reviewed with this skill. Registry compromise, a compromised upstream release, malicious registry configuration, or unintended package resolution could cause unreviewed package code to run. The command also initiates the download and installation of a Chromium artifact without a project-level integrity control documented in the repository.

Attack Path

  1. A user follows the prerequisite instructions in SKILL.md.
  2. The user runs npx playwright install chromium.
  3. If no trusted local Playwright version is available, npx resolves a package through the user's configured registry or cache.
  4. A compromised registry, upstream package release, or environment-specific resolution supplies unreviewed package code.
  5. npx executes the resolved Playwright CLI with the privileges of the invoking user.
  6. Malicious package code could access files, environment variables, network resources, and credentials available to that user or alter downloaded browser artifacts.

This path is conditional on dependency or registry compromise; no malicious Playwright payload is included in the audited project itself.

Impact Assessment

Exploited package code would execute with t ...[truncated 444 chars]

Remediation
View remediation

Remediation Suggestions

  1. Add Playwright to a reviewed dependency manifest using an exact version rather than resolving it dynamically.
  2. Commit a package-manager lockfile and require frozen or immutable lockfile installation, such as npm ci.
  3. Replace the setup command with an invocation of the previously installed, locked local dependency.
  4. Configure installations to use an approved registry over TLS and apply package provenance or signature verification where supported.
  5. Review lockfile changes and dependency updates before release, and use automated software composition analysis to detect compromised or vulnerable versions.
  6. Run browser installation under a non-privileged account and avoid exposing unrelated secrets or production credentials in the installation environment.
  7. Where operationally feasible, verify downloaded browser artifacts against trusted checksums or obtain them through a controlled internal artifact repository.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Rp1

Medium
Category
MCP Rug Pull
Confidence
93% confidence
Finding

The skill instructs users to run npx playwright install chromium without pinning a specific package version. Unpinned npx execution can fetch whatever version is current at install time, increasing supply-chain risk if a malicious or compromised release is published or if behavior changes unexpectedly. In this skill context, the command is part of setup and likely to be executed directly by users, which makes the risk more practical.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill exposes account-affecting and destructive capabilities such as publishing content, editing notes, deleting notes, commenting, following, and other social actions, but provides no warning, confirmation guidance, or safety constraints. This is dangerous because an agent or user could trigger irreversible or reputation-affecting actions accidentally, especially in an automation context tied to a real social-media account.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The skill shows an API key directly in configuration examples without any warning about secret handling, storage, or exposure risk. While the example uses a placeholder, users may copy the pattern into insecure configs, logs, screenshots, or version control, which can lead to credential leakage and unauthorized API usage.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.