ClawHub
Back to skill

Security audit

LangSkills Search

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent offline search helper, with a disclosed but real supply-chain caution around installing an unpinned package and auto-selected bundles.

Install this only in an isolated environment or virtualenv if possible, and consider pinning or reviewing the `langskills-rai` package and any bundles before using `bundle-install --auto`, especially in sensitive projects.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:24
Finding

Unpinned Third-Party Package and Dynamic Bundle Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 24–26
Vulnerability Type: Supply-chain risk from unpinned third-party dependencies and dynamically selected bundles
Risk Level: Medium

Vulnerable Code

bash
pip install langskills-rai
# Install matching bundles for the current project or pick a domain:
langskills-rai bundle-install --auto

Technical Analysis

The installation command does not constrain langskills-rai to a reviewed version or verify its integrity with a cryptographic hash. Package resolution can therefore retrieve a newer or compromised release whose behavior differs from the version originally reviewed.

The subsequent bundle-install --auto command dynamically selects and installs external bundles based on the current project. The Skill does not specify trusted bundle repositories, fixed bundle versions, checksums, signatures, or a manual review step. Because the package and bundles are absent from this repository, their implementation and runtime behavior cannot be audited from the supplied artifact.

Python package installation may execute package-controlled build or installation logic. Later CLI execution also runs code supplied by the installed package and its dependencies. This creates a supply-chain execution channel under the permissions of the user or Agent performing the setup.

Attack Path

  1. An Agent or user follows the documented first-time setup instructions.
  2. pip resolves the unpinned package and transitive dependencies from its configured package index.
  3. An attacker compromises a package release, dependency, publishing account, or applicable package-resolution source.
  4. Installation or subsequent CLI startup executes attacker-controlled code with the invoking process's permissions.
  5. The Agent runs bundle-install --auto, which obtains additional content without documented integrity or provenance verification.
  6. A compromised installer or bundle-handling component can manipula ...[truncated 874 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin langskills-rai to a specifically reviewed version rather than installing the latest available release.

  2. Use a locked requirements file containing cryptographic hashes, and install it with hash enforcement:

    bash
    python3 -m pip install --require-hashes -r requirements.txt

  3. Pin and hash all transitive dependencies through a reproducible dependency-locking process.

  4. Document and restrict trusted package indexes and bundle repositories. Disable fallback to untrusted or unintended sources.

  5. Require cryptographic signature or checksum verification for every downloaded bundle.

  6. Replace automatic bundle installation with an explicit selection and review step, or document exactly which bundles --auto may install.

  7. Perform installation in an isolated virtual environment or container with minimal filesystem, credential, and network access.

  8. Record the reviewed package version, bundle versions, source locations, checksums, and update procedure in the Skill documentation.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.