ClawHub
Back to skill

Security audit

Fnnas Fpk Development

Security checks for vulnerabilities and agentic risk

Overview

This is mostly a coherent FNNAS FPK development guide, but it also steers users toward optional third-party global tooling that can run code on their machine.

Install this only if you are comfortable with a Chinese FNNAS/fnOS development workflow and you will review optional third-party tool recommendations before running them. Treat the `uipro-cli` global npm command and extra skill recommendations as optional, run them only in an isolated development environment, avoid elevated shells, and prefer pinned/local tooling where possible.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:177
Finding

Unpinned Global Installation and Execution of a Third-Party npm Package

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 177
Vulnerability Type: Unpinned third-party dependency installed globally and immediately executed
Risk Level: Medium

Vulnerable Code

markdown
- Installation: `npm install -g uipro-cli && uipro init --ai codebuddy`

Technical Analysis

The Skill recommends globally installing the latest available release of the third-party uipro-cli npm package and immediately running its command. The instruction does not pin an exact package version or require verification through a lockfile, integrity hash, digital signature, package provenance record, or source review.

An npm package and its transitive dependencies may execute lifecycle scripts during installation. The subsequent uipro init command also directly runs package-controlled code. Because the package version is unpinned, the effective code can change after this Skill has been reviewed. Global installation additionally places package files and executable shims in shared system or user-level npm locations.

The GitHub URL elsewhere in the document is informational and does not cryptographically prove that the npm package being installed was built from the reviewed repository revision.

Attack Path

  1. An attacker compromises the uipro-cli package, its maintainer account, its publication process, or a transitive dependency.
  2. The attacker publishes a malicious release or dependency update.
  3. A user follows the Skill's instruction and runs npm install -g uipro-cli.
  4. npm retrieves the current package release and dependencies; malicious lifecycle scripts may execute during installation with the invoking user's privileges.
  5. The chained uipro init --ai codebuddy command immediately executes additional package-controlled logic.
  6. Malicious code can access data and modify files available to the invoking account and can alter globally installed npm tooling within that account's permission boundary.

Impact Assessm

...[truncated 716 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove the optional third-party installation recommendation unless it is essential to the Skill's declared FPK development function.
  2. If retained, pin an exact reviewed package version rather than resolving the latest release:
    bash
    npm install --global --ignore-scripts uipro-cli@<reviewed-version>
  3. Verify the package publisher, repository linkage, npm provenance, release signatures, and integrity metadata before recommending it.
  4. Review the pinned package and its full transitive dependency tree. Repeat the review before changing the pinned version.
  5. Prefer a project-local installation governed by a committed lockfile instead of a global installation.
  6. Avoid immediately chaining installation and execution. Separate these operations so users can inspect the installed package and generated command before execution.
  7. Disable npm lifecycle scripts where compatible. If lifecycle scripts are required, explicitly document and review them.
  8. Run third-party generators in an isolated, least-privilege environment without production credentials or sensitive mounted directories.
  9. Warn users not to invoke the installation through sudo or another elevated shell.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (8)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 9)May include surrounding context.

md
- "references/ALL_DOCS.md # 完整官方开发文档（优先查阅）"

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 18)May include surrounding context.

md
- "references/ALL_DOCS.md # 完整官方开发文档（优先查阅）"

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 32)May include surrounding context.

md
- "references/ALL_DOCS.md # 完整官方开发文档（优先查阅）"

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The trigger condition is broad, covering many generic FPK/fnOS-related keywords, which can cause the skill to activate in conversations where the user did not intend to invoke this workflow. Over-broad activation can inject rigid instructions, external recommendations, or workflow constraints into unrelated contexts, increasing the attack surface for accidental misuse or prompt-context interference.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

该 Markdown 文档从标题到正文均以中文编写，并直接面向开发者提供完整操作说明，但未说明这是仅面向中文用户的区域性文档，也未提供其他语言版本或用户选择语言的方式。按照语言/locale 政策，若技能内容强制限定特定语言而无用户选择或合理限定，应视为自然语言层面的策略问题。

Content

No source excerpt is available for this finding.

Unsafe Defaults

Medium
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · references/ALL_DOCS.md (reported line 1549)May include surrounding context.

md
## 权限控制

- `disable_authorization_path` - 是否禁用授权目录功能，默认为 false
    - 设置为 true 时，应用设置页面不会显示授权目录操作
    - 适用于不需要访问特定系统目录的应用

Context-Inappropriate Capability

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill recommends installing and using an unrelated external 'superpowers' skill before proceeding. This expands the trust boundary unnecessarily and can steer users into loading additional unreviewed instructions or prompt logic that are outside the FPK-development scope. In a skill ecosystem, chaining to unrelated skills increases the chance of prompt injection, data leakage, or workflow hijacking.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill promotes a third-party UI-generation toolchain and external skill, including installation and usage commands, even though this is not necessary for FPK packaging guidance. This introduces an avoidable supply-chain and instruction-chaining risk: users may install unvetted tooling or follow external prompts that could influence code generation, exfiltrate data, or weaken security controls.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.generated_source_template_injection

User-controlled placeholder is embedded directly into generated source code.

Critical
Code
suspicious.generated_source_template_injection
Location
references/ALL_DOCS.md:2005