ClawHub
Back to skill

Security audit

WebSocket Reconnect

Security checks for vulnerabilities and agentic risk

Overview

The skill matches its WebSocket reconnect purpose, but it should be reviewed because its central WebSocket dependency setup includes a reported-vulnerable ws version and a third-party package mirror.

Review before installing in production. Prefer regenerating the lockfile from the official npm registry, upgrading ws to a patched reviewed version, and using npm ci or equivalent lockfile enforcement. Treat WebSocket peers as untrusted unless you control them, and avoid passing sensitive headers or tokens unless the connection target is trusted.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
package-lock.json:18
Finding

Dependency Lockfile Uses a Non-Official Package Registry

Content
View full analysis

Vulnerability Details

File Location: package-lock.json:18-21
Vulnerability Type: Third-party dependency supply-chain risk
Risk Level: Medium

Vulnerable Code

json
"node_modules/ws": {
  "version": "8.19.0",
  "resolved": "https://registry.npmmirror.com/ws/-/ws-8.19.0.tgz",
  "integrity": "sha512-blAT2mjOEIi0ZzruJfIhb3nps74PRWTCz1IjglWEEpQl5XS/UNama6u2/rjFkDDouqr4L67ry+1aGIALViWjDg==",
  "license": "MIT",
  "engines": {
    "node": ">=10.0.0"
  },
  "peerDependencies": {
    "bufferutil": "^4.0.1",
    "utf-8-validate": ">=5.0.2"
  },
  "peerDependenciesMeta": {
    "bufferutil": {
      "optional": true
    },
    "utf-8-validate": {
      "optional": true
    }
  }
}

Technical Analysis

The lockfile directs npm to retrieve the runtime ws package from registry.npmmirror.com, a third-party mirror rather than the official npm registry. This introduces an additional supply-chain trust boundary for package availability and provenance.

The recorded SHA-512 integrity value provides meaningful protection against package content differing from the artifact represented by the current lockfile. It does not, however, remove the risks of a maliciously modified lockfile, compromised lockfile-generation environment, mirror availability failure, or reliance on an organization that has not been explicitly approved by the consumer.

No evidence was found that the currently locked ws package is malicious. The issue is the avoidable use of an external dependency distribution source.

Attack Path

  1. A user follows the installation instructions and runs npm install or npm ci.
  2. npm processes package-lock.json and requests the ws archive from https://registry.npmmirror.com/.
  3. An attacker would need to compromise the mirror, the dependency publication or lockfile-generation process, or modify the lockfile and its integrity value.
  4. A substituted dependency could subsequently be loaded by the following code at `scripts/websoc ...[truncated 1068 chars]
Remediation
View remediation

Remediation Suggestions

  1. Configure npm to use the official registry:
bash
npm config set registry https://registry.npmjs.org/
  1. Remove and regenerate the lockfile in a trusted environment:
bash
rm -rf node_modules package-lock.json
npm install
  1. Verify that the regenerated resolved entry points to https://registry.npmjs.org/ and retains a valid integrity hash.
  2. Commit the reviewed lockfile and use npm ci in CI/CD to enforce reproducible installation.
  3. Pin or deliberately manage dependency upgrades rather than accepting unreviewed changes.
  4. Add dependency vulnerability and provenance checks to CI, such as npm audit, lockfile policy validation, and software composition analysis.
  5. Run dependency installation and application workloads with least privilege and avoid exposing unnecessary secrets to installation scripts or runtime processes.
  6. If the mirror is intentionally required, document its approval, ownership, synchronization policy, integrity controls, and incident-response process.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (6)

Known Vulnerable Dependency: ws==8.19.0 — 2 advisory(ies): CVE-2026-45736 (ws: Uninitialized memory disclosure); CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)

High
Category
Supply Chain
Confidence
96% confidence
Finding

The lockfile pins ws to 8.19.0, and the finding identifies published advisories for an uninitialized memory disclosure and a memory-exhaustion denial of service. In a skill specifically intended to provide reliable WebSocket connection management, this dependency is central to runtime behavior, so a vulnerable ws version materially increases the risk of information disclosure or service disruption when handling hostile or malformed WebSocket traffic.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: ws==8.19.0 — 2 advisory(ies): CVE-2026-45736 (ws: Uninitialized memory disclosure); CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)

High
Category
Supply Chain
Confidence
80% confidence
Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

This markdown file contains the primary skill description in Chinese, while there is no indication that the user can choose another language or that the skill is intentionally region-specific. The policy explicitly allows locale constraints only when documented and justified, which is not present here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

This JavaScript example file uses Chinese natural-language comments, log messages, and usage text throughout, such as the title, examples, and runtime output strings. Because the file does not offer a language choice or explain that it is intended for a Chinese-only audience, it conflicts with the policy against forcing a specific language without user opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
92% confidence
Finding

The user-facing documentation is presented in Chinese throughout the skill description, features, and usage guidance, with no indication that the skill is region-specific or that other languages are supported. This can violate language/locale policy when users are not given an opt-in or alternative language option.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
97% confidence
Finding

The dependency uses a caret range (^8.14.0) rather than an exact pinned version, which reduces build reproducibility and can unintentionally pull in newer releases with different behavior or newly introduced defects. In a security-sensitive networking skill that automatically manages WebSocket connections, dependency drift increases supply-chain risk and makes it harder to control or audit the exact code executed.

Content

Scanner excerpt · package.json (reported line 21)May include surrounding context.

json
"author": "custom",
  "license": "MIT",
  "dependencies": {
    "ws": "^8.14.0"
  },
  "devDependencies": {},
  "engines": {

Static analysis

No suspicious patterns detected.