T08 · Insecure Dependencies
Warning
- Location
README.md:30- Finding
Unpinned Packages and Mutable Remote Sources Executed Through npx
- Content
View full analysis
- Remediation
View remediation
Security audit
Expor Native UI
Security checks for vulnerabilities and agentic risk
Overview
This is a documented Expo/React Native guidance skill with some supply-chain and permission-practice caveats, but no hidden execution, exfiltration, or deceptive behavior was found.
Install only if you are comfortable with Expo/React Native guidance that may recommend running unpinned npm/npx commands. For safer use, pin installer and dependency versions, review package lockfile changes, avoid --legacy-peer-deps unless necessary, and request camera/microphone/media permissions only after a clear user action in the app you build.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T08 · Insecure Dependencies
Warning
- Location
references/webgpu-three.md:22- Finding
Mutable Native Dependencies Installed with Peer-Dependency Validation Disabled
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
Findings (19)
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
From your project root:
bash mkdir -p .cursor/skills cp -r ~/.ai-skills/skills/frontend/expo-native-ui .cursor/skills/expo-native-ui
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 85% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
From your project root:
bash mkdir -p .claude/skills cp -r ~/.ai-skills/skills/frontend/expo-native-ui .claude/skills/expo-native-ui
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 85% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
Claude Code (global)
bash mkdir -p ~/.claude/skills cp -r ~/.ai-skills/skills/frontend/expo-native-ui ~/.claude/skills/expo-native-ui
External Model or Provider Selection
Medium
- Category
- Excessive Agency
- Confidence
- 90% confidence
- Finding
Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.
- Content
md --- name: expo-native-ui model: standard version: 1.0.0 description: > Build beautiful native iOS/Android apps with Expo Router. Covers route structure,
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 92% confidence
- Finding
The skill instructs users to run
npx clawhub@latest install expo-native-ui, which pulls and executes remote code at install time without a fixed version. Even though this is a common convenience pattern, it creates a supply-chain risk: a compromised package, tag, or dependency could execute arbitrary code on the user's machine.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 78% confidence
- Finding
npx expo startinvokes a package resolver/executor path that may fetch or run a non-pinned toolchain depending on the local environment. In a skill document, recommendingnpxexecution without version pinning increases reproducibility and supply-chain risk if the resolved package is unexpected or compromised.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 78% confidence
- Finding
npx expo run:iossimilarly relies on executing a potentially unpinned CLI tool, which can expose users to supply-chain compromise or inconsistent behavior across environments. Because this command can trigger build steps and native tooling interactions, a malicious or substituted package could have significant local impact.- Content
Behavior Manipulation
Medium
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Subtle instructions detected that may alter agent decision-making or introduce hidden biases.
- Content
md ## Best Practices - Always use SF Symbols over vector icon libraries - Match symbol weight to nearby text weight - Use `.fill` variants for selected/active states - Use PlatformColor for tint to support dark mode
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The guidance explicitly recommends requesting camera permission eagerly, which can normalize asking for sensitive access before clear user intent is established. In a mobile app skill focused on camera features, this can lead developers to build privacy-invasive flows that over-collect permissions, reduce meaningful consent, and increase the chance of unnecessary access to the device camera.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The manifest describes a skill focused on Expo Router, native tabs, animations, blur effects, liquid glass, SF Symbols, and platform UI patterns. This document instead positions the skill for 'ANY 3D graphics, games, GPU compute, or Three.js features,' which is a materially different capability area from native UI guidance.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The manifest presents the skill as a native UI helper, but this file adds advanced graphics-stack setup including WebGPU dependencies and installation instructions. GPU compute and low-level rendering setup are not obvious implementation details of Expo Router or native UI patterns; they expand the skill into graphics-engine configuration.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The instruction says to use this skill for "ANY 3D graphics, games, GPU compute, or Three.js features in React Native," which defines activation scope very broadly without boundaries or exclusion conditions. In a markdown skill reference, this can cause unintended invocation for a wide range of loosely related React Native requests.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
Line L003 states 'Never use FontAwesome or Ionicons,' which is an absolute prescriptive instruction. This enforces a single implementation choice without indicating whether exceptions, user preference, or project constraints are allowed, which can constitute an unnecessary policy-like restriction in natural-language guidance.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 79% confidence
- Finding
The phrase 'Never use AsyncStorage' is an unconditional natural-language directive that imposes a fixed technology choice without any stated exception, user opt-in, or contextual limitation. This fits the policy-violation category's concern about forcing a specific choice via natural-language instruction, even though it is framed as storage guidance rather than a user-selectable option.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 77% confidence
- Finding
The phrase "Always prefer NativeTabs" is a natural-language directive that enforces a single implementation choice universally. This can be interpreted as a policy-style mandate without offering user choice or context-based exceptions, which may conflict with guidance requiring opt-in or justified constraints.
- Content
Static analysis
No suspicious patterns detected.