FLWR Branding Studio Kit

• Outcome: Review
• Latest audit: Sep 10, 2026 · 3:25 PM UTC
• Version: 1.0.0

Overview

The skill appears to be a legitimate branding workflow, but its setup instructions include an unsafe unpinned and mismatched NPX command and it under-explains handling of private client material.

Review before installing. Prefer running the checked-in CLI directly or a pinned exact package name, and do not upload client recordings, transcripts, PDFs, or briefs unless you have authorization and have removed sensitive information. Expect the shipped package to provide scaffolding and reference guidance more than a complete autonomous strategist system.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: README.md:55

Finding

Unpinned and mismatched NPX package execution

Content

View full analysis

Vulnerability Details

File Location: README.md, lines 55-57
Vulnerability Type: Dependency confusion through an incorrect NPX package specifier
Risk Level: Medium

Vulnerable Code Snippet

bash

# Using NPX (Local)
npx flwr-kit "Client Name"

The package metadata identifies a different npm package name:

json

{
  "name": "flwr-branding-studio-kit",
  "bin": {
    "flwr-kit": "./bin/cli.js"
  }
}

Technical Analysis

The documentation invokes npx flwr-kit, but flwr-kit is only the executable alias declared by the project. The actual npm package name is flwr-branding-studio-kit.

NPX accepts a package specifier and may download a package from the npm registry when it cannot resolve a suitable local executable. Therefore, in an environment where the intended binary has not been installed locally, this command can resolve and execute a registry package named flwr-kit rather than the audited project.

The command also omits an exact version. Even if the resolved registry package is legitimate at one point, its effective code can change after this project has been reviewed.

Attack Path

1. A user clones the repository and follows the workflow in README.md.
2. The intended flwr-kit executable is unavailable in the relevant local NPX resolution context.
3. The user runs npx flwr-kit "Client Name".
4. NPX queries the npm registry for a package named flwr-kit.
5. An unrelated or attacker-controlled package is downloaded and executed.
6. Its lifecycle or executable code runs with the invoking user's operating-system permissions.

Impact Assessment

Successful exploitation permits arbitrary code execution with the privileges of the user running NPX. Depending on that user's environment, the downloaded package could:

• Read, modify, or delete files accessible to the user.
• Access source code and client briefing data in the workspace.
• Read environment variables and developer credentials available to the proce ...[truncated 367 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the ambiguous command with the exact package name and pin the reviewed version:

   bash

   npx flwr-branding-studio-kit@1.0.0 "Client Name"
   

2. For repository-local operation, prefer directly executing the checked-in implementation:

   bash

   node bin/cli.js "Client Name"
   

3. If the executable is expected to be locally installed, document the installation and verify resolution before execution:

   bash

   npm install
   npm exec -- flwr-kit "Client Name"
   

4. Keep the package name, binary alias, README examples, and release documentation consistent.

5. Pin versions in all commands that can retrieve executable packages from a registry, and review dependency updates before changing those pins.

6. Consider using lockfiles and CI checks that reject documentation commands referring to unknown or unintended npm package names.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match

Findings (18)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The code’s actual behavior is limited to local filesystem setup: sanitizing a client name, creating directories, and copying template files. While this partially matches the narrow phrase 'automates project setup,' it does not support the core description of being an advanced AI brand strategist that performs strategic analysis, applies elite methodologies, generates structured brand assets, or enforces hallucination controls. The primary purpose in code is a CLI scaffolding utility, which is materially narrower and different from the declared intelligent branding agent behavior.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · docs/SETUP_AUTOMATION.md (reported line 9)May include surrounding context.

md

1.  Crie sua conta ou faça login no [ClawHub](https://clawhub.com) (ou plataforma equivalente do SkillsMP).
2.  Vá nas configurações da sua conta (Settings/Profile).
3.  Procure por "API Tokens" ou "Access Tokens".
4.  Gere um novo token e **copie-o** (ele começa geralmente com `clh_`).

## Passo 2: Adicionar ao GitHub

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 89% confidence

Finding

The README instructs users to run npx flwr-kit without pinning a specific package version. npx resolves and executes the package version available at runtime, which can change over time or be replaced by a compromised release, creating a supply-chain execution risk. In this skill context, the command is presented as a primary setup path for users, which increases the likelihood of unsafe execution.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The activation phrase Start branding project for [Client Name]. is broad and does not define authorization, workspace, or data-scope constraints. In an agent skill, an overly generic trigger can cause the assistant to activate on loosely matching prompts and begin operating over available files or client data without explicit confirmation, increasing the risk of unintended actions or cross-project data exposure. The branding context lowers direct system impact compared with admin/devops skills, but the skill explicitly handles client intelligence, so confidentiality concerns make this meaningful.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 84% confidence

Finding

This repository structure section reiterates npx flwr-kit as the CLI entry point without any version pinning or trust boundary notes. Repetition in documentation reinforces an unsafe execution pattern: users may fetch and run whatever package version is current at the time, exposing them to malicious updates or typo/package takeover scenarios.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger phrase "Start branding project" is broad enough to match normal conversation, which can cause the skill to activate unintentionally. In an agent environment where activation may create folders, alter workspace state, or change the interaction flow, this increases the risk of unintended actions from ordinary user input.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The phrase "Start branding project" is a generic natural-language trigger that can easily appear in ordinary user conversation, causing the skill to invoke setup behavior unexpectedly. In an agent environment, broad triggers can lead to unintended file creation, template copying, or workflow execution without explicit user intent, which is a real safety and integrity issue even if the skill’s purpose is legitimate.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The file contains image prompts that prescribe specific ethnic/racial identities for subjects without any visible user-driven need, consent mechanism, or documented business justification. In a brand-strategy skill, this can normalize demographic steering and stereotype-driven content generation, which creates fairness, discrimination, and reputational risk even if it is not an exploit in the classic code-execution sense.

Content

No source excerpt is available for this finding.

YARA rule 'network_reconnaissance': Network reconnaissance and scanning patterns [hacktools]

Medium

• Category: YARA Match
• Confidence: 65% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · docs/extracted_visual_prompts.md (reported line 163)May include surrounding context.

md

lips. Hair in long
tight braid(s) or sleek braided ponytail. Small hoop earrings
or minimal jewelry.
She is mid-bite eating a sauced chicken wing, leaning
forward slightly with playful intensity and attitude, sauce
visible at the comer of her mouth, caught in an authentic
candid moment. One hand holding a branded paper food
tray or basket, the other hand bringing the wing to her
mouth. Expression fierce, fun, unapologetic, confident
street energy.
Chicken wing is large, crispy, glossy, coated in rich buffalo
or honey BBQ sauce, hyper-detailed crispy texture, juicy
shine, slight sauce drip. Professional food styling but with
street-food realism
Background is outdoor but blurred (shallow depth of field)
with a branded canopy or environment using deep New
York Yankees navy blue tones instead of green. Urban
daytime setting, natural sunlight mixed with flash
photography look
Lighting is bold, flash-heavy street photography style, sharp
highlights, punchy contrast, slight shadow depth, glos

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The entire skill guide is written as a prescriptive template in Portuguese and includes writing rules that assume this language context, but it does not indicate that language selection is optional or limited to a justified region-specific use case. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The entire skill guidance is written in Portuguese and includes example phrasing that assumes Portuguese output conventions, such as 'Respeite a escrita tradicional'. There is no indication that the skill is region-specific or that users may choose another language, which can violate a language/locale policy requiring user choice or explicit justification.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The guide explicitly instructs users to upload full meeting recordings, interviews, briefs, transcripts, and PDFs into an external AI project, but provides no safeguards around consent, confidentiality, data minimization, or handling of sensitive client information. In a brand-strategy workflow, these materials can contain proprietary business data and personal information, so this creates a real privacy and data-governance risk even if there is no obvious malicious intent.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The entire manual uses Portuguese-language instructions, which can constitute a language/locale policy issue when the skill does not provide user opt-in or an alternative language. There is no indication that this document is intentionally region-specific or that users may choose another locale.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

SQP-3 applies to all file types and covers language or locale policy violations. This document presents all instructions and terminology in Portuguese only, with no indication that the skill offers a language choice or that the locale restriction is justified as region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The guide explicitly says to 'force' the AI to use a particular capitalization/style convention. This imposes a language/locale-related writing policy without offering user choice or explaining a required business or regional constraint.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.