ClawHub
Back to skill

Security audit

Idea Check

Security checks for vulnerabilities and agentic risk

Overview

The skill has a clear idea-checking purpose, but it asks agents to run unpinned external tooling and passes user idea text through a shell-style command, creating review-worthy execution and privacy risk.

Install only if you are comfortable running the external MCP package and sending idea text to lookup services. Prefer pinning and verifying the npm and uvx packages first, and avoid using this skill with confidential product plans unless it is run in an isolated environment with explicit confirmation before calls.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
.
Finding

Unpinned Third-Party Packages Are Installed and Executed

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:17; README.md:11-12
Vulnerability Type: Unverified and unpinned executable dependencies
Risk Level: Medium

Vulnerable Code

SKILL.md:17:

bash
mcporter config add idea-reality --command "uvx idea-reality-mcp"

README.md:11-12:

bash
npm install -g mcporter
mcporter config add idea-reality --command "uvx idea-reality-mcp"

Technical Analysis

The setup instructions install mcporter globally from npm without a fixed version and configure uvx to retrieve and execute idea-reality-mcp without a fixed version, integrity hash, lockfile, or documented publisher verification.

This creates a supply-chain risk because the code executed by users can change after the skill itself has been reviewed. A compromised package release, compromised maintainer account, malicious dependency update, package-name takeover, or unexpected upstream change could result in arbitrary code running during installation or skill use. The global npm installation may also execute package lifecycle scripts in the invoking user's security context.

The project contains no evidence that either dependency is intentionally malicious. The vulnerability is the absence of controls ensuring that users execute the same reviewed dependency versions.

Attack Path

  1. An attacker compromises an upstream package, maintainer account, transitive dependency, or relevant package distribution channel.
  2. The attacker publishes a malicious release under the expected package name.
  3. A user follows the documented setup instructions or invokes the configured uvx command.
  4. The package manager resolves the unpinned package to the malicious release.
  5. Malicious installation hooks or package runtime code execute with the privileges of the user running npm, uvx, or mcporter.

Impact Assessment

Successful exploitation could provide arbitrary code execution und ...[truncated 428 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin both direct tools to explicitly reviewed versions rather than resolving the latest release.
  2. Record and verify package integrity hashes or signatures where supported.
  3. Document the expected package publishers, source repositories, and release provenance.
  4. Use lockfiles or equivalent immutable dependency resolution for the MCP server and its transitive dependencies.
  5. Avoid global npm installation where possible; install into an isolated, least-privileged environment.
  6. Disable or tightly control package lifecycle scripts unless they are required and audited.
  7. Run the MCP server in a sandbox or container with restricted filesystem, credential, and network access.
  8. Establish a dependency-update review process so version changes are audited before documentation is updated.

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:31
Finding

User-Controlled Idea Text Is Interpolated into a Shell Command

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:31-38
Vulnerability Type: Potential OS command injection
Risk Level: High

Vulnerable Code

markdown
### 3. Run the reality check

```json
{
  "tool": "exec",
  "command": "mcporter call idea-reality.idea_check idea_text=\"<extracted idea description>\" depth=quick"
}
text

### Technical Analysis

The workflow instructs the agent to extract an idea description from the user's message and interpolate it into an `exec` command string. Although the placeholder is surrounded by double quotes, the instructions do not require structured argument passing, shell-independent execution, validation, or shell-safe encoding.

Double quotes alone are not a sufficient defense when a command is interpreted by a shell. An attacker-controlled description containing quotation marks, command substitutions, separators, expansions, or other shell metacharacters could escape or alter the intended argument. The exact exploit syntax depends on the operating system, shell, and behavior of the host `exec` implementation.

The vulnerable data flow is:

```text
User message
    → extracted idea description
    → direct command-string interpolation
    → exec tool or shell interpretation
    → local command execution

Attack Path

  1. An attacker submits a project-idea message containing shell-control syntax disguised as part of the idea description.
  2. The skill follows its extraction instructions and preserves the hostile syntax in the extracted text.
  3. The agent substitutes that text into the command string shown in the workflow.
  4. The exec implementation passes the constructed string to a command shell.
  5. The shell interprets the injected syntax rather than treating the entire description as inert data.
  6. The attacker's command executes with the same operating-system privileges as the agent or automation process.

Exploitation depen ...[truncated 822 chars]

Remediation
View remediation

Remediation Suggestions

  1. Do not construct a shell command by concatenating or interpolating user-controlled text.
  2. Invoke mcporter through a structured process API that accepts an executable and an argument array separately.
  3. Prefer a native MCP tool call with typed parameters over the generic exec tool.
  4. Ensure the idea description is passed as one literal argument without shell evaluation.
  5. If a shell is unavoidable, use a platform-specific, well-tested argument-escaping library; do not rely solely on surrounding double quotes.
  6. Validate the selected depth against a strict allowlist such as quick or deep.
  7. Add adversarial tests covering quotation marks, command substitutions, newlines, separators, variable expansion, and platform-specific metacharacters.
  8. Run the command in a restricted environment with minimal filesystem permissions, filtered environment variables, and constrained network access.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Rp1

Medium
Category
MCP Rug Pull
Confidence
93% confidence
Finding

The README instructs users to run an MCP server via uvx idea-reality-mcp without pinning an exact version. This creates a supply-chain risk because future releases of that package could change behavior or become compromised, and users following the documentation would automatically execute the newer code.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The trigger description is broad enough to auto-activate on common brainstorming or market-research phrases, increasing the chance the skill runs without clear user intent. In this skill's context, that can cause unnecessary external calls and disclosure of sensitive project ideas to third-party services even when the user only wanted general discussion.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill does not warn that it sends the user's idea text to an MCP-backed external service and uses multiple external platforms for lookup. Because new project ideas may contain confidential business plans, trade secrets, or unpublished product concepts, silent transmission materially increases privacy and confidentiality risk.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
90% confidence
Finding

The skill instructs users to install and run an external MCP server via uvx idea-reality-mcp without pinning a version or integrity constraint. This creates a supply-chain risk: future package changes or a compromised release could alter tool behavior, execute unexpected code, or exfiltrate user idea data when the skill is used.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.