ClawHub
Back to skill

Security audit

Skill Creator Flagos

Security checks for vulnerabilities and agentic risk

Overview

This skill is a legitimate skill-building tool, but it needs review because it can persistently modify agent skills and its install/trigger guidance is broader than it should be.

Install only if you intend to let an agent create or edit skills in a controlled skills repository. Prefer a pinned or manual verified install path, review changes before committing them, and avoid broad natural-language invocation unless you want this meta-skill to activate automatically during skill-development tasks.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
README.md:272
Finding

Unpinned Third-Party Package Execution via npx

Content
View full analysis

Vulnerability Details

File Location: README.md, lines 272-279
Vulnerability Type: Unpinned third-party dependency execution
Risk Level: Medium

Vulnerable Code

bash
# Install this skill only
npx skills add flagos-ai/skills --skill skill-creator-flagos -a claude-code

# Or install all Flagos skills at once
npx skills add flagos-ai/skills -a claude-code

The same instructions also appear in README_zh.md, lines 270-277.

Technical Analysis

The installation instructions invoke the skills npm package through npx without specifying a package version, integrity hash, or trusted immutable source. If the package is not already installed locally, npx may retrieve and execute the version currently resolved by the configured npm registry.

Consequently, the code executed at installation time is not fixed to the version reviewed in this audit. A compromised package release, maintainer account, registry response, or upstream component could cause these commands to execute code that differs from the audited project. The subsequent installation of flagos-ai/skills also relies on mutable upstream content without a documented commit pin or checksum.

No evidence indicates that the currently bundled project is malicious. This finding concerns the mutable, unverified supply-chain execution path presented to users.

Attack Path

  1. An attacker compromises the npm package, a package maintainer account, the distribution channel, or another relevant upstream source.
  2. The attacker publishes or serves a modified version containing malicious installation or runtime behavior.
  3. A user follows the documented Quick Install procedure.
  4. npx resolves, downloads, and executes the unpinned package under the user's account.
  5. The malicious package accesses any files, environment variables, credentials, or network resources available to that user.

Impact Assessment

Successful exploitation cou ...[truncated 403 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin the npm package to a reviewed, exact version rather than resolving the latest available release:
    bash
    npx skills@<reviewed-exact-version> add flagos-ai/skills --skill skill-creator-flagos -a claude-code
  2. Verify the selected release's provenance, integrity metadata, maintainer ownership, and published contents before recommending it.
  3. Prefer explicit installation through a lockfile followed by npx --no-install, preventing an implicit network download during invocation.
  4. Pin upstream repository content to a reviewed commit or signed release instead of a mutable branch.
  5. Publish checksums or signatures and document a verification procedure before installation.
  6. Present the existing manual copy procedure as the preferred installation method when immutable provenance cannot be guaranteed.
  7. Apply equivalent corrections to README_zh.md, lines 270-277.
  8. Advise users not to run installation commands with elevated privileges.

SkillSpector

Vulnerability Patterns
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (19)

Self-Modification

High
Category
Rogue Agent
Confidence
85% confidence
Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · README.md (reported line 57)May include surrounding context.

Mode 1: Create — Build a New Skill from Scratch

text
Intent capture → Interview → Scaffold → Write SKILL.md → Add resources → Validate → Write README

What happens:

Self-Modification

High
Category
Rogue Agent
Confidence
85% confidence
Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · README.md (reported line 74)May include surrounding context.

Mode 1: Create — Build a New Skill from Scratch

text
Intent capture → Interview → Scaffold → Write SKILL.md → Add resources → Validate → Write README

What happens:

Self-Modification

High
Category
Rogue Agent
Confidence
85% confidence
Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · SKILL.md (reported line 264)May include surrounding context.

Mode 1: Create — Build a New Skill from Scratch

text
Intent capture → Interview → Scaffold → Write SKILL.md → Add resources → Validate → Write README

What happens:

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

The declared description describes a multi-function skill lifecycle tool covering creation, editing, validation, and testing. The supplied code chunk only implements one narrow subset: scaffolding a new skill directory and basic template files. It does not modify existing skills, validate skill quality/structure, or run tests. The creation/scaffolding portion is accurately represented, but the overall declared purpose materially overstates the implemented behavior in this code chunk.

Content

No source excerpt is available for this finding.

Vague Triggers

High
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger guidance is overly broad and includes generic phrases like 'create a skill', 'improve this skill', and 'validate my skill', which can cause unintended or opportunistic activation. In a meta-skill with write/edit capabilities, accidental invocation increases the chance of unauthorized file modifications or workflow hijacking in contexts where the user did not intend to run a repository-mutating skill.

Content

No source excerpt is available for this finding.

Self-Modification

High
Category
Rogue Agent
Confidence
85% confidence
Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · SKILL.md (reported line 29)May include surrounding context.

md
## Overview

This skill guides you through the full lifecycle of skill development:
1. **Create** — scaffold a new skill from template, interview the user, write SKILL.md
2. **Improve** — analyze an existing skill, identify weaknesses, iterate with test cases
3. **Validate** — check structure, frontmatter, references, and conventions compliance

Vague Triggers

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The instruction to make descriptions 'slightly pushy' and to 'err on the side of triggering too often' directly encourages collision-prone activation behavior. For a skill that can scaffold files, edit SKILL.md, run scripts, and modify repository contents, oversensitive triggering materially raises the risk of unintended execution and unsafe autonomous changes.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
77% confidence
Finding

文件以中文标题和全文中文说明呈现，但未说明这是可选本地化版本或用户可自行选择语言。根据规则，强制特定语言而没有用户选择或明确合理的区域限定，属于自然语言层面的语言/locale 策略风险。

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
85% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 286)May include surrounding context.

bash
# 在你的项目根目录执行
mkdir -p .claude/skills
cp -r <本仓库路径>/skills/skill-creator-flagos .claude/skills/

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
85% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README_zh.md (reported line 284)May include surrounding context.

bash
# 在你的项目根目录执行
mkdir -p .claude/skills
cp -r <本仓库路径>/skills/skill-creator-flagos .claude/skills/

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The troubleshooting advice recommends making trigger descriptions more aggressive when a skill does not trigger, reinforcing unsafe activation patterns. This is especially risky in a meta-skill that can create and alter other skills, because broadening triggers can propagate unsafe invocation behavior across the repository.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The line labels README.md as 'recommended, English', which sets an organizational expectation for a specific language. Under the policy rule, forcing or prescribing a language without opt-in or documented justification is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

These lines state that FlagOS skills 'should provide' an English README and a Chinese README, which is a locale/language policy baked into the documentation guidance. The text does not present this as an opt-in choice or explain a region-specific compliance reason, so it fits the natural-language policy violation category.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
89% confidence
Finding

This markdown file explains that the skill runs init_skill.py, generates a directory structure, creates scripts/resources, and writes README files. Because the skill affects the user's filesystem, the description should include a clear user-facing warning or disclosure that invoking these modes will create and modify files in the workspace.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
80% confidence
Finding

The Improve flow states that the agent saves test cases to evals/evals.json, and later sections describe generated evaluation results. This is a user-data-affecting write operation, but the markdown does not explicitly warn that running improve/eval flows will create or overwrite files in evals/ and related results paths.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.