ClawHub
Back to skill

Security audit

database-migrations

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent documentation-only database migration skill, with the main caution being an unpinned remote install command in the README.

The skill content itself is low risk and focused on database migration safety. Before installing, prefer a pinned release or commit and inspect the downloaded files, especially if using the npx command or installing globally into an agent's skill directory.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
README.md:29
Finding
Unpinned Third-Party Installation Command## Vulnerability Details **File Location**: `README.md`, lines 29–33 **Vulnerability Type**: Supply-chain risk from unpinned remote dependencies **Risk Level**: Medium ### Vulnerable Code ```bash npx add https://github.com/wpank/ai/tree/main/skills/api/database-migrations ``` ### Technical Analysis The installation command invokes the `add` package through `npx` without specifying an exact package version. It also obtains the Skill from the mutable `main` branch of an external GitHub repository rather than an immutable commit. Consequently, the package executed by `npx` and the remote Skill content can change after this project has been reviewed. The command does not perform checksum, signature, or provenance verification. This creates a supply-chain trust gap: a compromised npm package, npm account, GitHub repository, or maintainer account could cause users to execute altered installation logic or install malicious Skill content. No evidence establishes that either current remote source is malicious. The vulnerability is the unsafe, unpinned installation mechanism. ### Attack Path 1. An attacker compromises the npm package/account used by `npx`, the referenced GitHub repository, or a maintainer account. 2. The attacker publishes malicious installer behavior or modifies content under the mutable `main` branch. 3. A user follows the documented installation command. 4. `npx` resolves and executes the package available at that time, which retrieves or processes the mutable remote source. 5. Attacker-controlled logic may execute with the installing user's privileges, or malicious Skill instructions may be placed in the user's agent configuration. ### Impact Assessment Successful exploitation could execute commands with the privileges of the user running the installation, read or modify files accessible to that user, alter project or global AI-agent configuration, and install attacker-controlled Skill instructions. If t ...[truncated 216 chars]
Remediation
## Remediation Suggestions 1. Pin the installer package to an exact, reviewed version rather than allowing `npx` to resolve the current release. 2. Reference an immutable Git commit or signed release tag instead of the mutable `main` branch. 3. Verify downloaded content with a published cryptographic checksum or signature before installation. 4. Prefer downloading and inspecting a fixed archive followed by a non-executable copy operation when installer-time code execution is unnecessary. 5. Use a trusted package registry and enforce package provenance or signature validation where supported. 6. Run installation with least privilege in an isolated environment, without production credentials or unnecessary filesystem access. 7. Document the expected package version, source commit, and integrity digest so users can reproduce the audited installation.

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (5)

Session Persistence

Medium
Category
Rogue Agent
Content
- Rollback Strategies — reversible, forward-only, hybrid approaches
- Data Preservation — soft-delete, snapshot tables, point-in-time recovery, logical backups
- Blue-Green Database pattern
- Data Migration Patterns — backfill strategies, batch processing, dual-write period
- Testing Migrations — production-like data, migration CI pipeline
- Migration Checklist — pre-migration, during, and post-migration steps
Confidence
60% confidence
Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Rp1

Medium
Category
MCP Rug Pull
Confidence
92% confidence
Finding
The installation command uses a remote GitHub URL via `npx add` without any pinned version, commit, or integrity mechanism. That creates a supply-chain risk: future upstream changes, repository compromise, or dependency substitution could cause users to install different or malicious content than what was reviewed.

Skill Enumeration

Medium
Category
Agent Snooping
Content
From your project root:

```bash
mkdir -p .claude/skills
cp -r ~/.ai-skills/skills/api/database-migrations .claude/skills/database-migrations
```
Confidence
85% confidence
Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Skill Enumeration

Medium
Category
Agent Snooping
Content
#### Claude Code (global)

```bash
mkdir -p ~/.claude/skills
cp -r ~/.ai-skills/skills/api/database-migrations ~/.claude/skills/database-migrations
```
Confidence
85% confidence
Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

External Model or Provider Selection

Medium
Category
Excessive Agency
Content
---
name: database-migrations
model: standard
description: Safe, zero-downtime database migration strategies — schema evolution, rollback planning, data migration, tooling, and anti-pattern avoidance for production systems. Use when planning schema changes, writing migrations, or reviewing migration safety.
---
Confidence
90% confidence
Finding
Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Static analysis

No suspicious patterns detected.