ClawHub
Back to skill

Security audit

Sovereign Codebase Onboarding

Security checks for vulnerabilities and agentic risk

Overview

This is a repository-onboarding documentation skill whose main risk is that users should scope what code it reads and review setup commands before running them.

Install only if you are comfortable letting the assistant inspect the target repository. Run it on repos you are authorized to analyze, exclude secrets or sensitive directories where possible, and review any generated setup commands before running them, especially npx, Docker, ngrok, package installs, and curl-to-shell commands.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T03 · Remote Payload Retrieval and Execution

Error
Location
EXAMPLES.md:414
Finding

Remote Script Downloaded and Executed Without Verification

Content
View full analysis

Vulnerability Details

File Location: EXAMPLES.md:414
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Vulnerable Code:

markdown
- [ ] Install Rust via rustup: `curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh`

Technical Analysis

This instruction pipes a mutable network response directly into sh. Although HTTPS provides transport encryption and the referenced domain is the official rustup installation domain, the command does not verify a pinned artifact, checksum, digital signature, or expected script contents before execution.

The effective code can change after the Skill has been reviewed. A compromise of the remote host, its delivery infrastructure, or a trusted upstream component could cause arbitrary shell commands to execute. The shell inherits the invoking user's environment and permissions.

Installing Rust is not required for the Skill's declared codebase-analysis functionality. Even when Rust installation is relevant to an onboarding checklist, directly executing an unreviewed remote response exceeds the minimum privileges and trust necessary.

Attack Path

  1. The Skill generates or presents the Rust Day 1 checklist from the example.
  2. A user copies the provided command into a local shell.
  3. curl retrieves the current response from https://sh.rustup.rs.
  4. The response is passed directly to sh without inspection or integrity verification.
  5. If the response or delivery chain has been compromised, attacker-controlled commands execute with the user's permissions.
  6. Those commands can read accessible repository files and credentials, modify the user's files, install additional components, or establish persistence.

Impact Assessment

Successful exploitation provides arbitrary command execution under the account that runs the command. The payload could access all files and credentials available to that user, including sour ...[truncated 306 chars]

Remediation
View remediation

Remediation Suggestions

  • Remove the pipe-to-shell installation command from the example.
  • Prefer linking users to the official Rust installation documentation rather than generating a directly executable remote-script command.
  • Where an automated installation is necessary, download a versioned artifact separately, verify its publisher signature or a checksum obtained through an independent trusted channel, inspect it, and only then execute it.
  • Prefer a trusted operating-system package manager when an appropriate Rust package is available.
  • Add a Skill-level rule prohibiting generated curl | sh and wget | sh commands unless the user explicitly requests them and acknowledges the risk.
  • Ensure generated onboarding guides distinguish commands inferred from repository documentation from commands independently recommended by the Skill.

T08 · Insecure Dependencies

Warning
Location
README.md:39
Finding

Unpinned Package Execution Through npx

Content
View full analysis

Vulnerability Details

File Location: README.md:39-41
Vulnerability Type: Insecure dependency and package execution
Risk Level: Medium

Vulnerable Code:

bash
npx clawhub install sovereign-codebase-onboarding

Technical Analysis

The installation instructions invoke clawhub through npx without pinning an audited package version or documenting an integrity value. If the package is not already available locally, npx may resolve and execute mutable content from the configured npm registry.

This creates a supply-chain trust boundary: the executed CLI package can change independently of the reviewed Skill files. Registry-account compromise, package compromise, or an unexpected future release could cause attacker-controlled CLI or lifecycle code to execute during installation.

This risk is separate from the contents of the Skill itself. The repository contains only documentation files and no embedded installation script, but the documented installation path delegates code execution to an unpinned third-party package.

Attack Path

  1. A user follows the installation command in the README.
  2. npx resolves the unpinned clawhub package using the user's configured npm registry.
  3. If it is not cached locally, the selected package and its dependencies are downloaded.
  4. The package's CLI code, and any applicable installation behavior, executes with the user's permissions.
  5. If the resolved package version or dependency chain has been compromised, malicious code can run before or while the Skill is installed.

Impact Assessment

Exploitation can provide arbitrary code execution under the installing user's account. The reachable scope includes files, source repositories, environment variables, npm credentials, developer tokens, SSH material accessible to that account, and writable user configuration. The command does not explicitly request administrative privileges, so its normal privileg ...[truncated 86 chars]

Remediation
View remediation

Remediation Suggestions

  • Pin the installer to a specific audited version, for example by using an explicit package@version reference.
  • Publish and document the expected npm package name, publisher identity, registry, and verified release version.
  • Use lockfiles and registry integrity verification where the installation workflow supports them.
  • Review the pinned package and its transitive dependencies before recommending execution.
  • Offer copying the reviewed SKILL.md into the assistant configuration as the non-executable installation method.
  • Avoid recommending elevated execution and advise users to run installation commands with the least-privileged account necessary.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (9)

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

File System Enumeration

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.

Content

Scanner excerpt · README.md (reported line 12)May include surrounding context.

md
1. **Detect the tech stack** -- language, framework, project type, entry points
2. **Map the architecture** -- annotated directory tree, ASCII diagrams, dependency graph
3. **Identify patterns** -- design patterns, coding conventions, naming rules, error handling style
4. **Find key files** -- entry points, config, models, routes, "god files," complexity hotspots
5. **Generate an onboarding guide** -- structured document covering everything a new developer needs
6. **Answer questions** -- "Where does X happen?", "How does Y work?", "What breaks if I change Z?"

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
86% confidence
Finding

The examples discuss copying .env files, obtaining Stripe keys, and using a seeded test account with a concrete email/password, but they do not warn readers not to reuse test credentials, commit secrets, or expose webhook endpoints. In an onboarding context this can normalize insecure secret handling and weak credential practices, especially for new developers who may treat the example as prescriptive.

Content

No source excerpt is available for this finding.

External Script Fetching

Low
Category
Supply Chain
Confidence
95% confidence
Finding

The example recommends curl ... | sh, which downloads a remote script and immediately executes it in a shell. Even though rustup is legitimate, this pattern is inherently risky because it removes the opportunity to inspect the downloaded content and conditions users to trust remote code execution in a documentation context.

Content

Scanner excerpt · EXAMPLES.md (reported line 414)May include surrounding context.

md
## Day 1 Checklist for migrate-rs

### Environment Setup (20 min)
- [ ] Install Rust via rustup: `curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh`
- [ ] Verify: `rustc --version` should show 1.75+
- [ ] Install Docker (needed for integration tests against real databases)
- [ ] Clone: `git clone git@github.com:team/migrate-rs.git && cd migrate-rs`

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
82% confidence
Finding

The example includes commands that clone repositories, install toolchains, start Docker services, and run tests without any explicit warning that these actions modify the local system and may execute untrusted code from the repository or downloaded installers. In a codebase-onboarding skill, users are likely to copy commands verbatim, so omission of safety framing increases the chance of unsafe execution in a real environment.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The README encourages broad repository onboarding and architecture mapping without warning that the assistant may inspect the full repository, including secrets, .env files, internal configs, credentials, or regulated data checked into source. In a skill specifically designed to analyze arbitrary codebases, omitting this warning increases the chance users will expose sensitive material to the agent unintentionally.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.