ClawHub
Back to skill

Security audit

osc-bridge

Security checks for vulnerabilities and agentic risk

Overview

The skill is purpose-aligned for controlling music hardware and software, but its setup runs an unpinned npm package automatically, which users should review before installing.

Install only if you trust the @roomi-fields/osc-bridge npm package and repository. Prefer pinning the npm package to a reviewed version, avoid automatic unreviewed updates, and run the bridge with only the MIDI devices, local ports, and DAW targets you intend to control.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:27
Finding

Automatic Execution of an Unpinned npm Dependency

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 27–30
Vulnerability Type: Unpinned third-party package execution
Risk Level: Medium

json
"command": "npx",
"args": ["-y", "@roomi-fields/osc-bridge", "mcp",
         "--devices-dir", "/absolute/path/to/osc-bridge/devices"]

Technical Analysis

The recommended MCP configuration invokes npx -y with the package name @roomi-fields/osc-bridge but does not specify an exact package version or integrity digest. The -y option automatically accepts installation prompts. As a result, npm may retrieve and execute whichever package version the registry resolves when the MCP server starts.

This prevents the executable dependency from being reproducibly tied to an audited version. A future release can therefore execute code different from the code originally reviewed. The audited project contains neither the dependency's implementation nor a lockfile or integrity metadata that would allow the executed artifact to be verified.

This finding establishes a supply-chain exposure; it is not evidence that the named package is currently malicious.

Attack Path

  1. An attacker compromises the package maintainer account, npm publication channel, package itself, or a transitive dependency.
  2. The attacker publishes a malicious version that can be selected by the unpinned package reference.
  3. A user or agent launches the configured MCP server.
  4. npx -y retrieves the registry-resolved package without requesting installation confirmation.
  5. npm executes the malicious package in the local user context.
  6. The payload can exercise the filesystem, process, and network permissions available to that user.

Impact Assessment

Successful exploitation would provide arbitrary code execution with the privileges of the account running the MCP server. Depending on that account's permissions and environment, the malicious package could read or modify accessibl ...[truncated 347 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin the package to an exact reviewed version, such as @roomi-fields/osc-bridge@X.Y.Z, rather than relying on registry resolution of an unversioned reference.
  2. Install the dependency through a committed lockfile and use a reproducible, lockfile-enforcing installation command.
  3. Verify package provenance, signatures where available, and registry integrity metadata before execution.
  4. Prefer invoking a locally installed and reviewed binary rather than downloading a package at MCP startup.
  5. Remove -y where interactive approval is practical so unexpected installation is not accepted automatically.
  6. Run the MCP server under a dedicated least-privileged account or sandbox with narrowly scoped filesystem and network access.
  7. Establish a controlled dependency-update process in which new versions are reviewed and tested before the pinned version is changed.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.