ClawHub
Back to skill

Security audit

Context Driven Development

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent documentation workflow skill, with disclosed project-file reading and persistent context documents, but users should be cautious about its unpinned npx installation commands.

Install only from a trusted, reviewed source, preferably with a pinned package version or immutable commit. Expect the skill to have your agent read project files and git history and to create or update persistent context documents in the repository; confirm before allowing commits or broad documentation updates.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
README.md:25
Finding

Unpinned Third-Party Code Execution During Installation

Content
View full analysis

Vulnerability Details

File Location: README.md:25-33; also present in SKILL.md:15-19
Vulnerability Type: Unpinned and mutable third-party installation sources
Risk Level: Medium

Vulnerable Code

bash
npx add https://github.com/wpank/ai/tree/main/skills/meta/context-driven-development
bash
npx clawhub@latest install context-driven-development

Technical Analysis

The documented installation commands instruct users to retrieve and execute third-party JavaScript tooling through npx. The GitHub source refers to a mutable branch path rather than an immutable commit, while the ClawHub command explicitly selects the mutable latest release.

Consequently, the code executed during installation can change after this Skill has been reviewed. No fixed package version, commit hash, integrity digest, signature-verification procedure, or other mechanism is provided to ensure that the downloaded code matches an audited artifact.

This creates a supply-chain exposure: compromise of the upstream repository, package publisher account, registry, release pipeline, or transitive dependencies could cause a documented installation command to execute attacker-controlled code.

Attack Path

  1. An attacker compromises the upstream repository, package publisher account, registry artifact, release process, or relevant dependency.
  2. The attacker modifies the mutable branch or publishes a malicious version selected by @latest.
  3. A user follows one of the documented installation commands.
  4. npx retrieves the changed third-party package or installer.
  5. Package lifecycle hooks or CLI initialization code execute with the permissions of the user running the command.
  6. The malicious installer can access or modify resources available to that user before the compromise is detected.

Impact Assessment

Successful exploitation could provide arbitrary code execution with the installing user's pr ...[truncated 469 chars]

Remediation
View remediation

Remediation Suggestions

  1. Replace @latest with a specific, reviewed package version.
  2. Replace the mutable GitHub branch reference with an immutable commit hash or signed release tag.
  3. Publish and document expected integrity hashes or cryptographic signatures for installation artifacts.
  4. Verify package provenance and signatures before invoking installer code.
  5. Prefer an installation process that downloads and verifies an artifact before executing any of its contents.
  6. Pin and audit transitive dependencies associated with the installer.
  7. Document that installation should use a non-privileged account in an isolated environment.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (8)

Context Leakage

High
Category
Data Exfiltration
Confidence
75% confidence
Finding

Code or instructions that leak agent conversation context to external services, potentially exposing sensitive user interactions.

Content

Scanner excerpt · SKILL.md (reported line 186)May include surrounding context.

md
## Setup: Existing Project (Brownfield)

For existing codebases, extract context from what exists:

1. **Analyze the codebase:**
   - Read package.json, requirements.txt, go.mod, etc.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 43)May include surrounding context.

From your project root:

bash
mkdir -p .cursor/skills
cp -r ~/.ai-skills/skills/meta/context-driven-development .cursor/skills/context-driven-development

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
85% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 59)May include surrounding context.

From your project root:

bash
mkdir -p .claude/skills
cp -r ~/.ai-skills/skills/meta/context-driven-development .claude/skills/context-driven-development

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
85% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 66)May include surrounding context.

Claude Code (global)

bash
mkdir -p ~/.claude/skills
cp -r ~/.ai-skills/skills/meta/context-driven-development ~/.claude/skills/context-driven-development

External Model or Provider Selection

Medium
Category
Excessive Agency
Confidence
90% confidence
Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md
---
name: context-driven-development
model: reasoning
version: 2.0.0
description: >
  Treat project context as a managed artifact alongside code. Use structured context

Rp1

Medium
Category
MCP Rug Pull
Confidence
92% confidence
Finding

The installation command uses npx clawhub@latest, which pulls and executes the latest package version at runtime rather than a pinned, reviewed release. This creates a supply-chain risk because a compromised upstream package or unexpected breaking change could lead users to run untrusted code during installation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.