ClawHub
Back to skill

Security audit

tfl-cli

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent London transport CLI helper, with the main caution being its unpinned npm-based install.

Before installing, consider pinning or reviewing the npm package version and only provide TFL_APP_KEY if you need higher rate limits. The skill appears purpose-aligned, but the external CLI package is not vendored or integrity-pinned in this artifact.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:12
Finding

Unpinned Third-Party npm Package Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 12–18 and line 28
Vulnerability Type: Unpinned third-party dependency with globally installed executable
Risk Level: Medium

Vulnerable Code

json
"install":
  [
    {
      "id": "npm",
      "kind": "node",
      "package": "@shan8851/tfl-cli",
      "bins": ["tfl"],
      "label": "Install tfl-cli (npm)",
    },
  ]
sh
npm install -g @shan8851/tfl-cli

Technical Analysis

The Skill instructs the environment to install @shan8851/tfl-cli from npm without specifying an exact version or an integrity digest. The package reference therefore resolves to a mutable registry release, and the code installed in the future may differ from the code reviewed when this Skill was published.

The global installation command also makes the package's tfl executable available across the user's environment. npm lifecycle scripts, if present in the package or relevant dependencies, may execute during installation with the privileges of the user running npm.

The repository contains only SKILL.md; it does not include the dependency's source code, lockfile, integrity metadata, or a vendored reviewed copy. Consequently, the external CLI's implementation—including its handling of TFL_APP_KEY, travel locations, network requests, subprocesses, and transitive dependencies—cannot be verified from this artifact.

Attack Path

  1. An attacker compromises the npm publisher account, package distribution process, or a transitive dependency used by @shan8851/tfl-cli.
  2. The attacker publishes a malicious release that becomes the version selected by the unpinned package reference.
  3. A user or agent follows the Skill metadata or documented command and runs:
    sh
    npm install -g @shan8851/tfl-cli
  4. npm downloads the mutable release and may execute its installation lifecycle scripts.
  5. The malicious package executes with the installing user's privileges or later runs when the ag ...[truncated 984 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin the dependency to an exact, reviewed version rather than relying on the latest registry release:
    sh
    npm install -g @shan8851/tfl-cli@X.Y.Z
  2. Record and verify the package tarball's cryptographic integrity or checksum before installation.
  3. Prefer a lockfile-backed, project-local installation over a global installation where the runtime supports it.
  4. Review the pinned package, its lifecycle scripts, and all transitive dependencies before approval.
  5. Disable npm lifecycle scripts with --ignore-scripts if the reviewed package does not require them.
  6. Document the expected package source, publisher identity, repository, and network endpoints.
  7. Run the CLI under least privilege and expose only the environment variables and filesystem paths required for transport queries.
  8. Establish a controlled update process in which new package versions are reviewed and integrity-pinned before deployment.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.