ClawHub
Back to skill

Security audit

Wurd

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent Wurd document-compilation guide, with some disclosed but important privacy and supply-chain cautions around LLM plugins and unpinned npx use.

Installers should pin tsx or use a lockfile-backed project install before running commands, avoid LLM plugins for confidential documents unless the provider terms are acceptable, and clear .cache/llm/ when cached generated content should not remain on disk.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:13
Finding

Unpinned Third-Party Package Execution Through npx

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 13
Vulnerability Type: Supply-chain exposure through an unpinned executable dependency
Risk Level: Medium

Vulnerable Code:

bash
npx tsx src/cli.ts <path-to-markdown> [--no-cache] [--pdf] [--plugins <dir>]

Technical Analysis

The documented command invokes tsx through npx without specifying a version. If an audited local copy is unavailable, npx may resolve, download, and execute a package from the configured npm registry. The effective package version can therefore change after this Skill has been reviewed.

The project artifact contains only SKILL.md; it provides no package manifest, lockfile, integrity metadata, or other mechanism demonstrating that tsx is pinned to an audited release. This creates supply-chain risk because installation or runtime code from a compromised package release, registry account, transitive dependency, or configured registry could execute locally.

This finding does not establish that tsx is malicious. The vulnerability is the unsafe, unpinned download-and-execute workflow recommended by the Skill.

Attack Path

  1. An attacker compromises a package release, maintainer account, transitive dependency, or package registry used to resolve tsx.
  2. The attacker publishes or serves a malicious version under the expected package name.
  3. A user follows the documented command on a system where an audited local tsx version is not installed.
  4. npx resolves and downloads the attacker-controlled package version.
  5. Package installation or runtime code executes with the permissions and environment of the invoking user.
  6. The payload can access resources available to that user, subject to operating-system and sandbox restrictions.

Impact Assessment

Successful exploitation could result in arbitrary code execution with the invoking user's privileges. Potential scope includes readable a ...[truncated 404 chars]

Remediation
View remediation

Remediation Suggestions

  1. Add tsx to the project's devDependencies using an exact, reviewed version rather than relying on on-demand registry resolution.

  2. Commit a lockfile containing resolved versions and integrity hashes.

  3. Install dependencies with a lockfile-enforcing command such as npm ci.

  4. Invoke the installed local binary through a package script, for example:

    json
    {
  "scripts": {
    "wurd": "tsx src/cli.ts"
  },
  "devDependencies": {
    "tsx": "<exact-reviewed-version>"
  }
}

    Then document:

    bash
    npm ci
npm run wurd -- <path-to-markdown>

  5. Protect package installation with trusted-registry configuration, dependency review, provenance verification where available, and automated supply-chain scanning.

  6. Run document compilation in a least-privileged, isolated environment without unnecessary credentials or access to sensitive host files.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (5)

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill describes LLM-powered plugins and on-disk caching but does not clearly warn users that document content may be sent to a third-party API and responses stored locally in .cache/llm/. In a document-compilation workflow, users may process drafts, proprietary material, or regulated data, so omission of this disclosure can lead to unintended data exposure and retention.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
88% confidence
Finding

The skill explicitly configures an external API endpoint for LLM use, which means document content processed by LLM-backed plugins may leave the local environment. In context this transmission is intentional, but without prominent security/privacy caveats it creates a real risk of leaking sensitive document contents to an external service.

Content

Scanner excerpt · SKILL.md (reported line 108)May include surrounding context.

Create .env in the project root:

env
LLM_API_KEY=sk-...
LLM_BASE_URL=https://api.anthropic.com/v1
LLM_MODEL=claude-opus-4-6

Static analysis

Detected: suspicious.prompt_injection_instructions

Prompt-injection style instruction pattern detected.

Warn
Code
suspicious.prompt_injection_instructions
Location
SKILL.md:152