ClawHub
Back to skill

Security audit

api-versioning

Security checks for vulnerabilities and agentic risk

Overview

The skill content is a normal API versioning guide, but its README recommends an unpinned npx installation path that creates a supply-chain review concern.

Review the installation path before installing. The skill text itself is benign API versioning documentation, but prefer a pinned commit or trusted marketplace install over the README's unpinned `npx add` command, and avoid running that installer in a shell with sensitive credentials or elevated privileges.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
README.md:29
Finding

Unpinned Third-Party Code Execution Through npx

Content
View full analysis

Vulnerability Details

File Location: README.md, line 29
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code Snippet:

bash
npx add https://github.com/wpank/ai/tree/main/skills/api/api-versioning

Technical Analysis

The installation command invokes npx with the unversioned package name add. If the package is not already available locally, npx can retrieve and execute it from the configured npm registry. The command does not pin the executable package to a reviewed version or verify its integrity.

The GitHub source is also referenced through a mutable repository path rather than an immutable commit hash. Consequently, the effective installation content may change after this project has been audited. This creates a supply-chain trust boundary involving both the npm package used as the installer and the external GitHub repository.

This finding does not establish that either external source is currently malicious. The vulnerability is that the documented workflow permits subsequently modified or compromised third-party code to execute during installation without immutable version or integrity controls.

Attack Path

  1. An attacker compromises the npm package, its publisher account, the configured package registry, the GitHub account, or the referenced repository.
  2. The attacker publishes a malicious release of the unpinned add package or modifies content reachable through the mutable repository path.
  3. A user follows the documented installation command.
  4. npx retrieves and executes the externally controlled package in the user's environment.
  5. Malicious installer or lifecycle code executes with the permissions and environmental access of the invoking user.

Impact Assessment

Successful exploitation could provide arbitrary code execution under the installing user's account. The accessible scope may include project files, user-owned files, en ...[truncated 526 chars]

Remediation
View remediation

Remediation Suggestions

  • Avoid executing an unpinned registry package through npx for installation.
  • Use a trusted installer pinned to an exact package version, and enforce package-lock and integrity verification where supported.
  • Pin the external repository to a reviewed immutable commit hash or signed release rather than a mutable branch path.
  • Prefer a non-executing installation process, such as downloading or cloning a pinned revision and copying the required files.
  • Verify release signatures or published checksums before installation.
  • Document the exact expected package identity, version, source commit, and checksum.
  • Run any unavoidable installer in a restricted environment with no unnecessary credentials, minimal filesystem permissions, and no administrative privileges.
  • In CI/CD environments, allowlist dependencies and prevent installation scripts from accessing deployment secrets unless strictly required.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
Findings (8)

Anti-Refusal Statement

High
Category
Anti-Refusal
Confidence
80% confidence
Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · SKILL.md (reported line 115)May include surrounding context.

md
Never remove a version without warning. Follow this timeline:

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 39)May include surrounding context.

From your project root:

bash
mkdir -p .cursor/skills
cp -r ~/.ai-skills/skills/api/api-versioning .cursor/skills/api-versioning

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
85% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 55)May include surrounding context.

From your project root:

bash
mkdir -p .claude/skills
cp -r ~/.ai-skills/skills/api/api-versioning .claude/skills/api-versioning

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
85% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 62)May include surrounding context.

Claude Code (global)

bash
mkdir -p ~/.claude/skills
cp -r ~/.ai-skills/skills/api/api-versioning ~/.claude/skills/api-versioning

External Model or Provider Selection

Medium
Category
Excessive Agency
Confidence
90% confidence
Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md
---
name: api-versioning
model: standard
description: API versioning strategies — URL path, header, query param, content negotiation — with breaking change classification, deprecation timelines, migration patterns, and multi-version support. Use when evolving APIs, planning breaking changes, or managing version lifecycles.
---

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 142)May include surrounding context.

HTTP/1.1 200 OK Sunset: Sat, 01 Mar 2025 00:00:00 GMT Deprecation: true Link: https://api.example.com/docs/migrate-v1-v2; rel="sunset" X-API-Warn: "v1 is deprecated. Migrate to v2 by 2025-03-01."

text

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 154)May include surrounding context.

HTTP/1.1 200 OK Sunset: Sat, 01 Mar 2025 00:00:00 GMT Deprecation: true Link: https://api.example.com/docs/migrate-v1-v2; rel="sunset" X-API-Warn: "v1 is deprecated. Migrate to v2 by 2025-03-01."

text

Static analysis

No suspicious patterns detected.