ClawHub
Back to skill

Security audit

Syft News Pool (CLI)

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent Syft News integration, but it merits review because it installs an unpinned third-party CLI that is then used with account-linked news and profile data.

Review the Syft CLI dependency before installing, and prefer a pinned or otherwise verified CLI version. Use the skill only if you are comfortable with Syft account login, retrieval of followed topics, and local saved profile or briefing files; ask the agent to confirm before writing or overwriting artifacts.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:9
Finding

Unpinned Third-Party Executable Dependency

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 9–13
Vulnerability Type: Unpinned npm dependency and supply-chain risk
Risk Level: Medium

Vulnerable Code

yaml
install:
  - kind: node
    package: "@orionarm/syft-cli"
    bins:
      - syft

Technical Analysis

The skill installs the third-party npm package @orionarm/syft-cli without specifying an exact version, lockfile, cryptographic checksum, or equivalent integrity constraint. Consequently, the package version resolved during installation can differ from the version reviewed when the skill was published.

An npm installation may execute package lifecycle scripts. The resulting syft executable is also trusted by subsequent workflows involving account authentication, followed-topic retrieval, news searches, and local artifact generation. Because this project does not contain the dependency's source code, the executable's behavior cannot be verified from the audited files.

This is a supply-chain weakness rather than evidence that the current package is malicious.

Attack Path

  1. An attacker compromises the npm publisher account, package distribution channel, or a future release of @orionarm/syft-cli.
  2. The attacker publishes a malicious version under the same package name.
  3. A user installs this skill, and the unpinned dependency resolves to the malicious release.
  4. Malicious code runs through an npm lifecycle script or when the installed syft executable is invoked.
  5. The payload operates with the privileges of the user running the installation or CLI and may access data available to that account.

Impact Assessment

Successful exploitation could permit arbitrary code execution with the installing user's privileges. Depending on the local environment and the malicious package's implementation, the reachable scope could include local files, environment variables, CLI authentication material, generated profile or briefing artifacts, and modification of ...[truncated 135 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin @orionarm/syft-cli to an exact, security-reviewed version rather than allowing mutable version resolution.
  2. Use a lockfile with registry-provided integrity metadata and verify it during installation.
  3. Verify the package against an independently published checksum or signed provenance record where available.
  4. Disable npm lifecycle scripts during installation when they are not required; if they are required, audit each script before permitting execution.
  5. Document the authoritative package registry and upstream source repository to reduce dependency-confusion and source-substitution risk.
  6. Review the packaged CLI source and release artifacts before updating the pinned version.
  7. Perform dependency updates through a controlled process that includes source review, malware scanning, and regression testing.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 244)May include surrounding context.

md
### 5. Guidance Capture

1. Never persist a durable rule from one raw sentence without confirmation.
2. First summarize your understanding.
3. Ask whether the summary is correct.
4. Ask whether the user wants it saved for future runs.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

The default prompt uses a broad, generic invocation phrase that can cause the skill to be triggered in situations beyond a clearly scoped user request. Because this skill is profile-aware and tied to news retrieval/briefing behavior, overly permissive invocation increases the chance of unintended activation, unnecessary data use, or prompt-surface abuse through loosely related conversations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill instructs the agent to create and update local artifacts in specific workspace paths, but it does not warn the user that files will be written or modified. In an agent setting, silent workspace writes can surprise users, overwrite existing notes, or persist sensitive derived data without explicit consent, especially because the skill frames these outputs as standard operating behavior.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.