ClawHub
Back to skill

Security audit

Command Creator

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent slash-command authoring helper, but its install instructions and examples normalize high-impact automated repo actions without enough safety boundaries.

Review before installing. Prefer an immutable, pinned installation source instead of the README's `npx add` command, and be careful when using this skill to create commands that can edit files, stage all changes, create commits, publish PRs, or run project scripts. Generated commands should include explicit confirmation steps for destructive, broad, or externally visible actions.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
README.md:21
Finding

Unpinned Third-Party Installer and Mutable Remote Source

Content
View full analysis

Vulnerability Details

File Location: README.md, lines 21–25
Vulnerability Type: Supply-chain exposure through an unpinned executable dependency and mutable remote source
Risk Level: Medium

Vulnerable Code

markdown
## Installation

```bash
npx add https://github.com/wpank/ai/tree/main/skills/tools/command-creator
text

### Technical Analysis

The installation command invokes `npx add`, which may download and execute the npm package named `add` if an appropriate local copy is unavailable. The package is not pinned to an exact version or verified using a documented integrity value.

The source artifact is also retrieved from a personal GitHub repository through the mutable `main` branch. Consequently, the content installed in the future may differ from the content covered by this audit.

This creates two supply-chain trust boundaries:

1. The npm package resolved for `add`.
2. The GitHub account, repository, and mutable branch supplying the Skill.

Compromise, package replacement, or malicious modification at either boundary could cause users to execute installer logic or install Skill instructions that were not reviewed.

### Attack Path

1. An attacker compromises the npm package, its publisher account, the GitHub account, or the referenced repository.
2. The attacker publishes malicious installer behavior or modifies content on the `main` branch.
3. A user follows the documented installation instructions.
4. `npx` resolves and executes the unpinned installer package.
5. The installer retrieves mutable repository content and may execute arbitrary commands or write modified files.
6. Malicious behavior runs with the privileges of the user performing the installation.

### Impact Assessment

Successful exploitation could provide arbitrary code execution under the installing user's account. The resulting scope may include reading or modifying files accessible to that user, altering project or global agent configuration, stealing develop
...[truncated 265 chars]
Remediation
View remediation

Remediation Suggestions

  1. Replace the ambiguous npx add invocation with a documented, trusted installer package pinned to an exact version.
  2. Pin the GitHub source to a reviewed commit hash or immutable, signed release tag rather than main.
  3. Publish and verify a cryptographic checksum for the downloaded artifact.
  4. Prefer a transparent manual installation procedure that downloads a fixed archive, verifies its checksum, and copies only the expected files.
  5. Use npm lockfile integrity metadata where npm dependencies are unavoidable.
  6. Document the exact files and installation destinations so users can inspect changes before applying them.
  7. Run installer tooling with the minimum necessary privileges and avoid privileged or system-wide execution.

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (21)

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 3)May include surrounding context.

md
# Command Creator

Create Claude Code slash commands — reusable markdown workflows invoked with `/command-name`. Slash commands are markdown files in `.claude/commands/` (project) or `~/.claude/commands/` (global) that expand into prompts when invoked.

## What's Inside

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The 'When to Use' section includes broad activations like 'create', 'make', 'add a slash command', 'new command', 'automate this workflow', and 'make this repeatable' without clear constraints or exclusion examples. Several of these phrases overlap with normal conversational requests and could cause unintended invocation outside a narrow slash-command creation context.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
85% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 50)May include surrounding context.

From your project root:

bash
mkdir -p .claude/skills
cp -r ~/.ai-skills/skills/tools/command-creator .claude/skills/command-creator

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
85% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 57)May include surrounding context.

Claude Code (global)

bash
mkdir -p ~/.claude/skills
cp -r ~/.ai-skills/skills/tools/command-creator ~/.claude/skills/command-creator

External Model or Provider Selection

Medium
Category
Excessive Agency
Confidence
90% confidence
Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md
---
name: command-creator
model: fast
description: |
  WHAT: Create Claude Code slash commands - reusable markdown workflows invoked with /command-name.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 5)May include surrounding context.

md
name: command-creator
model: fast
description: |
  WHAT: Create Claude Code slash commands - reusable markdown workflows invoked with /command-name.
  
  WHEN: User wants to create, make, or add a slash command. User wants to automate a repetitive workflow or document a consistent process for reuse.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The activation description includes generic intents like "create," "make," "add a command," and "new command," plus broad phrases such as "automate this workflow" and "make this repeatable." These phrases are not tightly scoped and could match ordinary user requests that are not specifically asking to invoke this skill, increasing the risk of unintended activation.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The guidance first says to use the Bash tool for make commands, then immediately says 'DO NOT use Bash tool for make commands.' This is an active contradiction in the documentation, not merely an omission, and could cause the generated command behavior to diverge from the stated intent of clear, reliable command-authoring guidance.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/best-practices.md (reported line 282)May include surrounding context.

markdown
## Progress Reporting

Use TodoWrite to track your progress:

- Create todos at the start for each iteration
- Mark as in_progress when starting

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The document instructs authors to use editing operations on user files but does not require transparent disclosure that the resulting command may modify local files. In a reusable slash-command ecosystem, omission of that warning can cause unexpected integrity-impacting changes and reduce user ability to make informed decisions before invocation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The guidance encourages state-changing git operations such as staging and committing without requiring an explicit warning, confirmation boundary, or disclosure that repository state will be modified. In an agent-executed command context, this can lead users to invoke workflows that silently alter version-control state, creating integrity and change-management risks.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
99% confidence
Finding

This section again instructs readers to 'ALWAYS use Bash tool' for make commands and then says 'DO NOT use Bash tool for make commands.' Because this file is supposed to provide authoritative best practices for creating commands, the contradiction undermines the documented intent and may lead to malformed generated commands.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
99% confidence
Finding

The section labeled as the correct approach tells the reader to use Bash for make commands, then ends with 'DO NOT use Bash tool for make commands.' Labeling a self-contradictory example as correct is an explicit intent/documentation divergence that can mislead downstream command creation.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
84% confidence
Finding

The directive to create commands that execute autonomously without asking clarifying questions increases the chance that agents will make consequential decisions under ambiguity. In combination with examples involving edits, git staging, commits, and command execution, this can amplify unsafe actions and reduce human oversight at precisely the points where confirmation is most valuable.

Content

Scanner excerpt · references/best-practices.md (reported line 719)May include surrounding context.

md
9. **Track progress** (TodoWrite for multi-step)
10. **Verify each step** (check results before proceeding)

Focus on creating commands that agents can execute autonomously without asking clarifying questions.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This example instructs non-interactive remote operations (gt submit --stack --publish --no-edit --restack) that can create or update pull requests and publish drafts without an explicit warning or approval step. In a command-creation skill, examples strongly shape generated commands, so this normalizes potentially broad remote side effects that could expose code, trigger CI, or alter multiple PRs unexpectedly.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

This example explicitly instructs the agent to run git add . and git commit as part of the workflow, which modifies the repository state and may capture unintended files, secrets, or unrelated changes. Because the example is presented as a reusable command reference without a clear user-confirmation checkpoint or warning about write side effects, downstream commands modeled on it may perform irreversible local changes too eagerly.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The document explicitly includes patterns that create commits, submit PRs, and otherwise modify repository state, but it does not require user confirmation or warn that these actions can have irreversible side effects. In a command-creation skill, these examples may be copied into generated commands, causing downstream automation to perform write or network actions without an explicit safety checkpoint.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The document recommends direct Bash execution for tools like make, pytest, pyright, and gt without warning that shell commands may execute arbitrary project-defined scripts, hooks, or networked operations. In the context of a command-authoring skill, this is more dangerous because it can propagate a norm of executing shell commands from untrusted repositories without validating side effects first.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
87% confidence
Finding

The pattern instructs saving results to disk after approval, but it does not consistently frame file writes as a sensitive operation requiring explicit disclosure of the target path and overwrite behavior. In a skill whose purpose is to generate reusable commands, omission of those safeguards can normalize unsafe write patterns in derived commands.

Content

No source excerpt is available for this finding.

Scope Creep

Low
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · references/patterns.md (reported line 285)May include surrounding context.

md
- Identify if deeper work needed

2. If issues found:
   - Expand scope progressively
   - Add todos for each issue category
   - Handle incrementally

Static analysis

No suspicious patterns detected.