ClawHub
Back to skill

Security audit

Hauscout

Security checks for vulnerabilities and agentic risk

Overview

The skill fits its real-estate collection purpose, but it should be reviewed because it tells an agent to run unaudited local code, write persistent data, and push Git changes without clear confirmation controls.

Install only if you control /Users/kendrick/projects/hauscout and understand that running the skill can scrape HouseSigma, call AI services, write or update Neon database records, create local memory summaries, and publish repository changes. Prefer dry-run first, use scoped DATABASE_URL credentials, verify dependencies from a lockfile, inspect scripts/collect.ts, review git status and diffs, and approve any push manually.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:14
Finding

Unpinned Package Execution Through npx

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 12-15; a second occurrence appears at lines 36-46
Vulnerability Type: Unpinned third-party package execution
Risk Level: Medium

Vulnerable Code

bash
cd /Users/kendrick/projects/hauscout
npx tsx scripts/collect.ts

The database inspection instructions similarly invoke the package without an explicit version:

bash
cd /Users/kendrick/projects/hauscout
npx tsx -e "
import { neon } from '@neondatabase/serverless';
import { drizzle } from 'drizzle-orm/neon-http';
import * as schema from './src/db/schema';
// .env.local 로드 필요
const sql = neon(process.env.DATABASE_URL!);
const db = drizzle(sql, { schema });
const all = await db.select().from(schema.listings);
console.log(JSON.stringify(all, null, 2));
"

Technical Analysis

The Skill invokes tsx through npx without specifying an exact version or requiring a verified, locally installed dependency. If a suitable local executable is unavailable, npx may resolve and download a package from the configured npm registry. The resulting executable is then run with the current user's permissions.

The command also executes scripts/collect.ts from the external absolute directory /Users/kendrick/projects/hauscout. That script and its dependency metadata were not included in the audited artifact, so their integrity and behavior cannot be verified from this project.

This creates a supply-chain boundary in which execution may depend on mutable registry content, local npm configuration, dependency resolution, and an unaudited external project directory.

Attack Path

  1. An attacker compromises or influences the npm registry, configured registry mirror, package-resolution configuration, or the relevant package distribution.
  2. Alternatively, an attacker with access to the external project modifies its dependency configuration or scripts/collect.ts.
  3. The agent follow ...[truncated 975 chars]
Remediation
View remediation

Remediation Suggestions

  1. Declare tsx as a project dependency at an exact, reviewed version and commit the package manifest and lockfile.
  2. Install dependencies using a lockfile-enforcing command such as npm ci rather than permitting ad hoc package resolution.
  3. Invoke the verified local executable through a package script, for example npm run collect, instead of relying on an unversioned npx command.
  4. Consider using npx --no-install tsx ... if npx remains necessary, so execution fails rather than downloading a missing package.
  5. Verify package integrity and provenance, use a trusted registry, and protect npm configuration from unauthorized modification.
  6. Include the referenced collection script, dependency manifests, and relevant source files within the auditable project boundary.
  7. Run the collector with a least-privileged account and provide only the environment variables and filesystem access required for the task.
  8. Replace the inline database command with a reviewed, version-controlled diagnostic script that limits output to necessary records and fields.

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:31
Finding

Unrestricted Git Commit and Push Instruction

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 31
Vulnerability Type: Unsafe repository publication workflow
Risk Level: Medium

Vulnerable Code

text
5. git commit & push (변경사항 있을 때만)

Technical Analysis

The Skill instructs the agent to commit and push whenever changes exist, but it does not require inspection of the working tree, review of the staged diff, validation of the configured remote, secret scanning, file allowlisting, or explicit user approval.

Although the instruction does not specify an unsafe staging command itself, an automated agent may interpret it broadly and stage all repository changes. Collection output, persistent memory summaries, unrelated user modifications, generated files, or accidentally created credentials could consequently be included in a commit and transmitted to the configured Git remote.

Attack Path

  1. The collection process, another local process, or an attacker with repository write access creates or modifies files in /Users/kendrick/projects/hauscout.
  2. The changes include sensitive data, unrelated work, manipulated generated content, or credential-bearing files.
  3. The agent follows the checklist without first reviewing git status, the complete diff, and the destination remote.
  4. The agent stages the affected files, creates a commit, and pushes it.
  5. Anyone with access to the remote repository can retrieve the published content. If the remote or branch is attacker-controlled, the attacker receives it directly.

Impact Assessment

Exploitation can cause unauthorized disclosure of any repository content that the agent stages and commits, including operational records, collected property data, persistent memory notes, unrelated source changes, or secrets accidentally written into the working tree.

The instruction does not itself grant new operating-system privileges. Its direct scope is the repository and any Git remote for whic ...[truncated 150 chars]

Remediation
View remediation

Remediation Suggestions

  1. Do not make pushing a default post-collection action. Require explicit user authorization immediately before any remote write.
  2. Require the agent to run and present git status --short, inspect the complete staged and unstaged diff, and verify the intended branch.
  3. Verify the destination with git remote -v and confirm that the remote repository and branch are authorized.
  4. Stage only an explicit allowlist of expected files. Prohibit blanket staging commands such as git add . and git add -A.
  5. Run secret scanning and inspect generated files for credentials, connection strings, personal data, and unexpected collection output before committing.
  6. Ensure .env*, credential files, database exports, browser profiles, and sensitive memory files are excluded through repository policy and .gitignore.
  7. Use a narrowly scoped Git credential that can write only to the intended repository and protected branch workflow.
  8. Separate commit creation from push authorization so a reviewed local commit can be created without automatically publishing it.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (5)

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 46)May include surrounding context.

md
import { neon } from '@neondatabase/serverless';
import { drizzle } from 'drizzle-orm/neon-http';
import * as schema from './src/db/schema';
// .env.local 로드 필요
const sql = neon(process.env.DATABASE_URL!);
const db = drizzle(sql, { schema });
const all = await db.select().from(schema.listings);

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill description explicitly says it will collect external real-estate data, perform AI analysis, and store results in Neon PostgreSQL, but it does not warn the user that network access and persistent database writes will occur. In an agent setting, missing disclosure can lead to unintended outbound traffic, site scraping, and state-changing operations without informed consent.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
91% confidence
Finding

The skill instructs running npx tsx without pinning an exact package version, which can cause execution of whatever version is currently resolved from the registry or local environment. In an agent-executed skill, this introduces supply-chain risk because a compromised or incompatible package version could run arbitrary code during collection.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
91% confidence
Finding

This command again uses npx tsx without an exact pinned version for an inline script that accesses the database. That creates avoidable supply-chain and reproducibility risk, especially because the command can touch sensitive data and environment-provided credentials.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
81% confidence
Finding

The natural-language description and trigger phrases are entirely in Korean, and the file does not indicate that language selection is optional or that the skill is intentionally limited to Korean-speaking users. Under the stated policy, forcing a specific language without opt-in can be a language/locale policy violation.

Content

No source excerpt is available for this finding.