ClawHub
Back to skill

Security audit

auth-patterns

Security checks for vulnerabilities and agentic risk

Overview

This is a straightforward authentication guidance skill; the main caution is that its README suggests an unpinned remote install command.

The skill itself is normal auth reference material. Before installing, prefer a pinned commit or manually review the files instead of running the unpinned `npx add` command from a mutable GitHub branch, especially on a machine with sensitive project or account credentials.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
README.md:29
Finding

Unpinned Third-Party Code Execution During Installation

Content
View full analysis

Vulnerability Details

File Location: README.md, line 29
Vulnerability Type: Unpinned executable dependency and mutable remote source
Risk Level: Medium

Vulnerable Code

bash
npx add https://github.com/wpank/ai/tree/main/skills/api/auth-patterns

Technical Analysis

The installation command uses npx to resolve and execute the package that provides the add command. When that package is not already available locally, npx may retrieve executable code from the npm ecosystem and run it with the current user's privileges.

The command does not specify an exact package version or integrity hash. It also references content through a mutable GitHub branch path rather than an immutable, reviewed commit. Therefore, the code executed or installed by this command can change after the Skill has been audited without any corresponding modification to this repository.

This creates a supply-chain trust gap. Although the audited files contain no confirmed malicious payload, compromise or replacement of the resolved npm package or upstream repository could turn the documented installation procedure into an arbitrary code-execution channel.

Attack Path

  1. An attacker compromises the package resolved by npx add, its maintainer account, publishing credentials, or the referenced upstream repository.
  2. The attacker publishes a modified installer or changes content reachable through the mutable repository path.
  3. A user follows the installation command documented in README.md.
  4. npx downloads and executes the altered package without validating it against an audited version or integrity hash.
  5. The malicious installer executes with the privileges of the user running the command.
  6. The payload may read or modify accessible source code, configuration files, Agent instructions, environment variables, credentials, or other user-owned data.

Impact Assessment

Successful exploitation provides co ...[truncated 476 chars]

Remediation
View remediation

Remediation Suggestions

  1. Replace the npx add command with a non-executing installation process where practical, such as downloading or cloning reviewed files and copying them into the intended Skill directory.
  2. Pin the upstream repository to an immutable commit hash instead of a mutable branch:
    bash
    git clone https://github.com/wpank/ai.git
cd ai
git checkout <reviewed-commit-hash>
  3. Publish and verify a cryptographic checksum or signed release before installing files.
  4. If an npm-based installer is necessary, use the explicit trusted package name and an exact version rather than the ambiguous unpinned npx add invocation:
    bash
    npx --yes trusted-package@<exact-version> ...
  5. Pin dependency integrity metadata through an npm lockfile and verify package provenance or registry signatures where supported.
  6. Document the expected package owner, registry, commit, checksum, and files installed so users can verify the source before execution.
  7. Run installation with least privilege in an isolated environment, without unnecessary credentials or access to unrelated sensitive directories.

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (8)

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 28)May include surrounding context.

Dual-Token Strategy

Short-lived access token + long-lived refresh token:

text
Client → POST /auth/login → Server

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 87)May include surrounding context.

Dual-Token Strategy

Short-lived access token + long-lived refresh token:

text
Client → POST /auth/login → Server

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 85)May include surrounding context.

md
| Token | Lifetime | Rotation |
|-------|----------|----------|
| **Access token** | 5–15 minutes | Issued on refresh |
| **Refresh token** | 7–30 days | Rotate on every use |
| **ID token** | Match access token | Not refreshed |

Rp1

Medium
Category
MCP Rug Pull
Confidence
90% confidence
Finding

The README instructs users to install directly from a remote GitHub path via npx add without pinning to a specific immutable version, tag, or commit. This creates a supply-chain risk: if the upstream repository changes or is compromised, future installations could fetch unexpected or malicious content.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 39)May include surrounding context.

From your project root:

bash
mkdir -p .cursor/skills
cp -r ~/.ai-skills/skills/api/auth-patterns .cursor/skills/auth-patterns

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
85% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 55)May include surrounding context.

From your project root:

bash
mkdir -p .claude/skills
cp -r ~/.ai-skills/skills/api/auth-patterns .claude/skills/auth-patterns

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
85% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 62)May include surrounding context.

Claude Code (global)

bash
mkdir -p ~/.claude/skills
cp -r ~/.ai-skills/skills/api/auth-patterns ~/.claude/skills/auth-patterns

External Model or Provider Selection

Medium
Category
Excessive Agency
Confidence
90% confidence
Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md
---
name: auth-patterns
model: standard
description: Authentication and authorization patterns — JWT, OAuth 2.0, sessions, RBAC/ABAC, password security, MFA, and vulnerability prevention. Use when implementing login flows, protecting routes, managing tokens, or auditing auth security.
---

Static analysis

No suspicious patterns detected.