ClawHub
Back to skill

Security audit

Dual Stream Architecture

Security checks for vulnerabilities and agentic risk

Overview

The skill itself is ordinary architecture guidance, but its documented install commands use mutable remote execution that users should review before running.

Review the install commands before use. Prefer a pinned ClawHub version or immutable commit and avoid running npx-based installers in an environment with sensitive credentials unless you trust the installer source. The skill content itself is coherent Kafka/Redis architecture guidance.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:16
Finding

Unpinned Third-Party Packages and Mutable Sources Executed Through npx

Content
View full analysis
Remediation
View remediation
install dual-stream-architecture ``` 2. Pin repository-based installations to an immutable commit hash rather than a mutable branch or tree path. 3. Publish expected SHA-256 checksums or cryptographic signatures and require users to verify downloaded artifacts before installation. 4. Prefer a non-executing download and manual-copy workflow when practical. If an installer must execute, document its publisher, exact version, expected integrity value, and required permissions. 5. Maintain lockfiles for executable package dependencies and review transitive dependency changes before updating the pinned version. 6. Run installation in a sandbox or least-privileged environment without production credentials, SSH keys, cloud tokens, or access to sensitive project files. 7. Document a controlled upgrade process so newer versions are reviewed and pinned rather than selected automatically. ]]>

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (8)

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The README instructs users to execute npx add against a remote GitHub source without any version pinning or integrity control. That creates a supply-chain risk: future changes to the referenced package or repository could cause users to fetch and run unexpected code.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
97% confidence
Finding

Using npx clawhub@latest install dual-stream-architecture pulls and executes the latest published code at runtime, which is inherently mutable. If the package is compromised or a malicious version is later published, users following the README could execute attacker-controlled code.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 40)May include surrounding context.

From your project root:

bash
mkdir -p .cursor/skills
cp -r ~/.ai-skills/skills/realtime/dual-stream-architecture .cursor/skills/dual-stream-architecture

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
85% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 56)May include surrounding context.

From your project root:

bash
mkdir -p .claude/skills
cp -r ~/.ai-skills/skills/realtime/dual-stream-architecture .claude/skills/dual-stream-architecture

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
85% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 63)May include surrounding context.

Claude Code (global)

bash
mkdir -p ~/.claude/skills
cp -r ~/.ai-skills/skills/realtime/dual-stream-architecture ~/.claude/skills/dual-stream-architecture

External Model or Provider Selection

Medium
Category
Excessive Agency
Confidence
90% confidence
Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md
---
name: dual-stream-architecture
model: reasoning
description: Dual-stream event publishing combining Kafka for durability with Redis Pub/Sub for real-time delivery. Use when building event-driven systems needing both guaranteed delivery and low-latency updates. Triggers on dual stream, event publishing, Kafka Redis, real-time events, pub/sub, streaming architecture.
---

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

The description lists triggers such as "dual stream," "event publishing," and "streaming architecture," which are broad terms commonly used in ordinary technical conversation. The file does not provide clear activation boundaries or exclusion examples, so the skill could be invoked unintentionally in loosely related discussions.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
91% confidence
Finding

The installation command uses npx clawhub@latest, which pulls whatever version is current at execution time rather than a reviewed, fixed release. That creates a supply-chain risk: a compromised upstream package, typosquatted replacement, or breaking update could cause users to install and run untrusted code when following the skill instructions.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.