ClawHub
Back to skill

Security audit

Jet

Security checks for vulnerabilities and agentic risk

Overview

The skill is a straightforward JET task-management helper with disclosed CLI setup, credential configuration, and task/admin mutation controls.

Install only if you trust the JET npm package and service, prefer a reviewed or pinned CLI version where possible, avoid running global npm installs as an administrator, and only allow force or admin commands when you intentionally want workspace-level changes.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:13
Finding

Unpinned Global npm Package Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 13
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code:

sh
npm install -g @just-easy-tasks/jet

Technical Analysis

The setup documentation instructs users to install the current registry release of @just-easy-tasks/jet globally without pinning a reviewed version or requiring package-integrity verification. Consequently, the effective code installed by this command can change after the Skill has been audited.

npm package installation can execute package lifecycle scripts. A compromised package release, maintainer account, or registry delivery path could therefore cause attacker-controlled code to run with the privileges of the user performing the installation. The global installation scope also places package files and executable links in shared user-level or system-level npm locations.

The package name is consistent with the service described by the Skill. There is no direct evidence in the audited file that the referenced package is currently malicious, typosquatted, or compromised. The finding concerns the unsafe, mutable dependency-installation practice.

Attack Path

  1. An attacker compromises the npm package, its publisher account, or its release process.
  2. The attacker publishes a malicious release under the referenced package name.
  3. A user follows the Skill instruction after that release becomes the registry default.
  4. npm retrieves the mutable release and may execute attacker-controlled lifecycle scripts during installation.
  5. The malicious package executes with the installing user's privileges and may modify files or commands accessible to that account.

Impact Assessment

Successful exploitation could permit arbitrary code execution with the privileges of the user running npm. The accessible scope may include that user's files, environment variables, credentials, and globally installed ...[truncated 240 chars]

Remediation
View remediation

Remediation Suggestions

  • Pin the dependency to a specifically reviewed release, for example:
    sh
    npm install -g @just-easy-tasks/jet@1.0.0
  • Document the expected npm registry and avoid permitting installation from arbitrary registry overrides.
  • Verify package provenance, signatures, or published integrity information where supported.
  • Review package contents and lifecycle scripts before approving version upgrades.
  • Prefer a locked, isolated execution environment over a global installation when practical.
  • Establish a controlled update process so new releases are security-reviewed before the documented version is changed.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.