ClawHub
Back to skill

Security audit

Decision Frameworks

Security checks for vulnerabilities and agentic risk

Overview

This is a documentation-only decision-framework skill with ordinary installation instructions and no hidden runtime behavior, though its unpinned npx install commands should be used cautiously.

This skill appears safe to install as a decision-making reference. Prefer a pinned ClawHub or repository version instead of the mutable npx examples, and review any installer before running it in a sensitive workspace.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:17
Finding

Unpinned third-party installation commands permit mutable supply-chain execution

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:17; README.md:26; README.md:32
Vulnerability Type: Unpinned and mutable third-party installation sources
Risk Level: Medium

Vulnerable Code

SKILL.md:17:

bash
npx clawhub@latest install decision-frameworks

README.md:26:

bash
npx add https://github.com/wpank/ai/tree/main/skills/meta/decision-frameworks

README.md:32:

bash
npx clawhub@latest install decision-frameworks

Technical Analysis

The documented installation procedures instruct users to retrieve and execute third-party npm packages without pinning them to immutable, reviewed versions.

The clawhub@latest specification explicitly resolves to whichever release is currently tagged as latest. Its executable contents can therefore change after this audit without any modification to this repository. The npx add command similarly retrieves and executes the npm package named add, while passing a mutable GitHub branch URL under tree/main. Neither the npm package nor the referenced repository content is pinned to a reviewed version or commit, and no checksum or integrity verification is provided.

Because npx executes downloaded package code, a compromised package publisher, npm account, package release, or upstream repository could convert these installation instructions into an arbitrary-code execution channel. This is a supply-chain weakness rather than evidence that the currently referenced packages are malicious.

Attack Path

  1. An attacker compromises the publisher account, npm package, release process, or mutable upstream repository used by one of the documented commands.
  2. The attacker publishes malicious CLI or lifecycle code under the version resolved by @latest, the package invoked as add, or content referenced by the mutable GitHub branch.
  3. A user follows the installation instructions from SKILL.md or README.md.
  4. npx ...[truncated 900 chars]
Remediation
View remediation

Remediation Suggestions

  1. Replace @latest with an exact, reviewed npm package version, for example clawhub@X.Y.Z.
  2. Pin GitHub-hosted content to a reviewed commit SHA rather than the mutable main branch.
  3. Replace the ambiguous npx add ... invocation with a clearly identified and version-pinned installer.
  4. Publish and verify cryptographic checksums or package integrity metadata before installation.
  5. Prefer lockfiles, package-manager integrity controls, and trusted registries with provenance verification.
  6. Review the selected package version and its lifecycle scripts before recommending it.
  7. Where practical, download and inspect the installer separately rather than combining retrieval and execution in one command.
  8. Document that installation must run as an unprivileged user and must not be invoked with sudo or equivalent elevation.

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (7)

Rp1

Medium
Category
MCP Rug Pull
Confidence
93% confidence
Finding

The README instructs users to run npx add against a GitHub URL without pinning to a specific immutable version or commit. This creates a supply-chain risk because the referenced remote package or installer behavior can change over time, causing users to execute unexpected code during installation.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The command npx clawhub@latest install decision-frameworks explicitly tracks latest, which means users will execute whatever package version is current at install time. If the package is compromised or a breaking change is introduced, the README becomes a vector for unintended code execution or supply-chain compromise.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 44)May include surrounding context.

From your project root:

bash
mkdir -p .cursor/skills
cp -r ~/.ai-skills/skills/meta/decision-frameworks .cursor/skills/decision-frameworks

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
85% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 60)May include surrounding context.

From your project root:

bash
mkdir -p .claude/skills
cp -r ~/.ai-skills/skills/meta/decision-frameworks .claude/skills/decision-frameworks

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
85% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 67)May include surrounding context.

Claude Code (global)

bash
mkdir -p ~/.claude/skills
cp -r ~/.ai-skills/skills/meta/decision-frameworks ~/.claude/skills/decision-frameworks

External Model or Provider Selection

Medium
Category
Excessive Agency
Confidence
90% confidence
Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md
---
name: decision-frameworks
model: reasoning
description: Structured decision-making patterns for common engineering choices — library selection, architecture, build vs buy, prioritization, reversibility analysis, and ADRs. Use when choosing between tools, architectures, or approaches, or when documenting technical decisions.
---

Rp1

Medium
Category
MCP Rug Pull
Confidence
94% confidence
Finding

The installation command uses npx clawhub@latest, which fetches and executes the newest published package version at install time rather than a reviewed, immutable version. This creates a supply-chain risk: if the package is compromised or a breaking/malicious release is published, users of the skill could execute untrusted code simply by following the documented install step.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.