ClawHub
Back to skill

Security audit

Helmet

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed library-account helper, but users should be careful because it installs an unpinned npm CLI that handles library credentials.

Install only if you trust the @helmet-ai/helmet npm package and are comfortable storing library card numbers, PINs, and session cookies locally. Prefer a reviewed pinned version if available, and review commands before allowing renewals or hold changes.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:11
Finding

Unpinned Third-Party npm Package Executes with Access to Sensitive Account Data

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:11-16, SKILL.md:36-38, and SKILL.md:260-264
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

The Skill installs and executes the third-party npm package @helmet-ai/helmet without pinning an exact version or verifying package integrity.

Relevant code (SKILL.md:11-16):

yaml
install:
  - id: node
    kind: node
    package: "@helmet-ai/helmet"
    bins:
      - helmet

Relevant code (SKILL.md:36-38):

bash
# Install
npm install -g @helmet-ai/helmet

Relevant code (SKILL.md:260-264):

bash
npm install -g @helmet-ai/helmet@latest
helmet --version   # must be ≥ 0.2.0

Technical Analysis

Both the Skill installation metadata and documented installation commands resolve a mutable package release. The troubleshooting procedure explicitly uses the @latest distribution tag. Neither an exact reviewed version nor an integrity hash is supplied.

npm package installation can execute package lifecycle scripts, and the installed helmet executable subsequently runs with the privileges of the invoking user. The external package implementation is not included in this project, so its credential handling, network behavior, and executable code cannot be independently audited from the supplied artifact.

This is particularly sensitive because the Skill documentation states that the CLI handles library card numbers, PINs, authenticated cookie jars, account information, and state-changing operations such as placing or canceling holds. A compromised publishing account, malicious package release, or other supply-chain compromise could therefore introduce arbitrary code after this Skill has been reviewed.

The wrapper in scripts/helmet-cli.sh forwards arguments safely using "$@"; no command-injection issue was found in that wrapper. The risk arises from trusting and executing the mutable external ...[truncated 1847 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin @helmet-ai/helmet to a reviewed exact version in both the installation metadata and all documentation, rather than using an unqualified package name or @latest.
  2. Remove the npm install -g @helmet-ai/helmet@latest recommendation. Provide a controlled upgrade process that identifies a specific reviewed version.
  3. Use a lockfile and npm integrity metadata in a reproducible local installation. Verify the package tarball checksum before installation where the hosting framework permits it.
  4. Vendor or include the CLI source in the audited project so its handling of PINs, cookies, network requests, and state-changing operations can be reviewed.
  5. Prefer a project-local installation over a global mutable executable, and invoke the exact local binary.
  6. Disable npm lifecycle scripts during installation when they are not required, for example with npm install --ignore-scripts, after confirming that this does not break legitimate functionality.
  7. Establish a dependency review and update process that checks package provenance, publisher changes, release signatures or attestations, transitive dependencies, and security advisories before adopting a new version.
  8. Document restrictive filesystem permissions for configuration and session data, and minimize the runtime environment's access to unrelated user files.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep