ClawHub
Back to skill

Security audit

E2E Testing Patterns

Security checks for vulnerabilities and agentic risk

Overview

This is a straightforward E2E testing guidance skill, with no hidden behavior found, but users should treat its mutable npx install examples carefully.

Before installing, prefer a pinned or reviewed ClawHub version and avoid running mutable npx commands in a sensitive environment. In projects and CI, keep Playwright and related tools as pinned dev dependencies with a lockfile.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Error
Location
SKILL.md:18
Finding

Unpinned Third-Party Code Execution During Installation

Content
View full analysis

Vulnerability Details

File Locations:

  • SKILL.md:18
  • README.md:25
  • README.md:31

Vulnerability Type: Unpinned and mutable third-party installation dependencies
Risk Level: High

Vulnerable Code

SKILL.md:18:

bash
npx clawhub@latest install e2e-testing-patterns

README.md:25:

bash
npx add https://github.com/wpank/ai/tree/main/skills/testing/e2e-testing-patterns

README.md:31:

bash
npx clawhub@latest install e2e-testing-patterns

Technical Analysis

The documented installation commands use npx to retrieve and execute third-party npm packages without pinning them to reviewed, immutable versions.

The clawhub@latest reference is explicitly mutable. Its resolved package version and implementation can change after this skill has been reviewed. The npx add command similarly executes the unpinned npm package named add; supplying a GitHub tree URL as an argument does not pin the executed npm package or the referenced repository content to an immutable commit.

npm command-line packages and their lifecycle behavior execute with the permissions of the user running the installation. Consequently, compromise of the package publisher account, registry package, transitive dependency chain, or referenced mutable repository could turn these installation instructions into a remote code-execution channel.

Attack Path

  1. An attacker compromises the publisher account, npm package, dependency chain, or mutable upstream repository associated with one of the installation commands.
  2. The attacker publishes a malicious package version or replaces mutable upstream content.
  3. A user follows the installation instructions and runs the documented npx command.
  4. npx downloads the current, unreviewed package and its dependencies.
  5. Malicious CLI, lifecycle, or dependency code executes with the installing user's privileges.
  6. The payload can access or modi ...[truncated 935 chars]
Remediation
View remediation

Remediation Suggestions

  1. Replace @latest with an exact, reviewed package version:

    bash
    npx clawhub@1.2.3 install e2e-testing-patterns

  2. Pin repository-based installation sources to a full immutable commit SHA rather than a branch or GitHub tree URL.

  3. Commit a lockfile containing dependency versions and integrity hashes where package-based installation is required.

  4. Verify package provenance, publisher identity, signatures, and registry integrity metadata before execution.

  5. Prefer downloading and inspecting a versioned artifact before running it instead of directly executing remotely retrieved code through npx.

  6. Execute installation in a sandbox or least-privileged environment without production credentials, sensitive environment variables, or unrestricted filesystem access.

  7. Document the expected artifact checksum and provide a verification command so users can validate downloaded content before installation.

  8. Review and pin transitive dependencies, and use automated dependency monitoring to detect publisher changes, compromised releases, and integrity mismatches.

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (12)

Rp1

Medium
Category
MCP Rug Pull
Confidence
86% confidence
Finding

The README instructs users to run npx add against a remote GitHub URL without pinning to an immutable version, tag, or commit. This creates a supply-chain risk because the fetched content can change over time, allowing a compromised upstream repository or dependency chain to deliver unexpected code or altered installation behavior.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
91% confidence
Finding

Using npx clawhub@latest install e2e-testing-patterns explicitly requests the latest version, which is mutable and can change between executions. If the package or one of its dependencies is compromised, users may execute attacker-controlled install logic or retrieve altered skill content.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 45)May include surrounding context.

From your project root:

bash
mkdir -p .cursor/skills
cp -r ~/.ai-skills/skills/testing/e2e-testing-patterns .cursor/skills/e2e-testing-patterns

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
85% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 61)May include surrounding context.

From your project root:

bash
mkdir -p .claude/skills
cp -r ~/.ai-skills/skills/testing/e2e-testing-patterns .claude/skills/e2e-testing-patterns

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
85% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 68)May include surrounding context.

Claude Code (global)

bash
mkdir -p ~/.claude/skills
cp -r ~/.ai-skills/skills/testing/e2e-testing-patterns ~/.claude/skills/e2e-testing-patterns

External Model or Provider Selection

Medium
Category
Excessive Agency
Confidence
90% confidence
Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md
---
name: e2e-testing-patterns
model: standard
category: testing
description: Build reliable, fast E2E test suites with Playwright and Cypress. Critical user journey coverage, flaky test elimination, CI/CD integration.
version: 1.0

Rp1

Medium
Category
MCP Rug Pull
Confidence
93% confidence
Finding

The installation command uses npx clawhub@latest, which pulls and executes the newest remote package version at runtime. That creates a supply-chain risk: a compromised upstream package or unexpected breaking change could result in execution of unreviewed code on the user's machine.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
79% confidence
Finding

The documented npx playwright test --headed command invokes a package without a pinned version, which can cause execution of whatever version resolves in the environment if Playwright is not already installed locally. In environments where npx fetches from the registry, this exposes users to supply-chain and reproducibility risks.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
79% confidence
Finding

The npx playwright test --debug example relies on unpinned runtime package resolution. If npx downloads a fresh package version, users may execute unreviewed code or encounter inconsistent behavior across runs.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
79% confidence
Finding

The npx playwright show-report command has the same risk pattern as other unpinned npx invocations: it may fetch and execute remote code depending on the user's environment. While intended for developer convenience, it weakens supply-chain safety and reproducibility.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
82% confidence
Finding

In the CI example, npx playwright install --with-deps may download and execute an unpinned Playwright package version during automated builds. CI environments are high-value targets for supply-chain attacks because compromise can affect build artifacts, secrets, and downstream deployments.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
84% confidence
Finding

The CI step npx playwright test can trigger unpinned package execution if the package is not strictly resolved from the checked-in dependency set. In CI, this increases risk because unexpected package resolution can lead to arbitrary code execution within the pipeline context.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.