ClawHub
Back to skill

Security audit

topaz

Security checks for vulnerabilities and agentic risk

Overview

This skill is purpose-aligned for enhancing media with Topaz through RunAPI, with a disclosed but notable dependency-trust risk from installing the RunAPI CLI via Homebrew.

Before installing, confirm you trust the RunAPI Homebrew tap and prefer a reviewed or pinned CLI version when available. Only provide a RunAPI API key you intend this tool to use, and only submit media files you are comfortable uploading to RunAPI for Topaz processing.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:13
Finding

Unpinned RunAPI CLI Installation from a Mutable Third-Party Homebrew Tap

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 13–18
Vulnerability Type: Supply-chain risk from an unpinned third-party executable dependency
Risk Level: Medium

yaml
install:
- kind: brew
  formula: runapi-ai/tap/runapi
  bins:
  - runapi

Technical Analysis

The skill declares installation of the runapi executable from the custom Homebrew tap runapi-ai/tap without pinning an immutable package version or formula revision. It also does not require validation through a publisher signature, checksum, or equivalent integrity mechanism.

Consequently, the executable installed when the skill is used may differ from the version that was reviewed. If the tap, formula repository, release infrastructure, or maintainer account is compromised, an attacker could distribute altered installation or runtime code through the expected package name. The project does not include a vendored implementation that would permit independent review of the executable's behavior.

This is particularly security-sensitive because the installed CLI is subsequently expected to interact with RunAPI authentication data and user-selected local media.

Attack Path

  1. An attacker compromises the custom Homebrew tap, its maintainer account, the referenced package release infrastructure, or another component of its distribution chain.
  2. The attacker modifies the formula or referenced artifact while retaining the legitimate runapi-ai/tap/runapi package identity.
  3. An agent follows the skill metadata and installs the current, unpinned package.
  4. Malicious code executes during package installation or when the agent invokes the runapi command.
  5. The malicious process operates with the privileges of the installing or invoking user and may access data available to that process, including RunAPI credentials, CLI configuration, and media files supplied for processing.

Impact Assessment

Successful exploitation ...[truncated 551 chars]

Remediation
View remediation

Remediation Suggestions

  • Pin the RunAPI CLI to a reviewed release and, where supported, an immutable Homebrew formula revision or repository commit.
  • Verify downloaded artifacts using a publisher-provided cryptographic signature or a documented SHA-256 checksum before installation or execution.
  • Explicitly identify and validate the canonical package repository and release source.
  • Configure automated dependency monitoring so version changes trigger a fresh security review before adoption.
  • Avoid automatic installation when the expected version and artifact integrity cannot be established.
  • Run the CLI with least privilege and limit its access to only the credentials and media files required for the current task.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.