Security audit

Skill Extraction

Security checks for vulnerabilities and agentic risk

Overview

The skill appears purpose-aligned, but users should review it because it can scan a whole repository, create or copy generated skill files, and recommends mutable npx-based installation commands.

Install only from a pinned, reviewed version or commit, and ask the agent for a proposed file plan before running extraction. Review generated docs and skills before committing or copying them to another repository, especially if the source project contains private code or business-specific patterns.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

Location: README.md:13
Finding: Unpinned npx Installers Allow Mutable Third-Party Code Execution
Content: View full analysis
Remediation: View remediation
/skills/extraction/pattern-extraction ``` 3. Avoid invoking the generic, unpinned `add` package. Use a verified and documented installer pinned to an exact version. 4. Where supported, verify package provenance, checksums, signatures, and npm integrity metadata before execution. 5. Use lockfiles and automated dependency scanning for any maintained installer environment. 6. Run installation with a least-privileged account in an isolated environment, without unnecessary secrets or production credentials. 7. Document the expected publisher, package identity, exact version, and integrity value so users can verify that they are installing the reviewed artifact. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The command explicitly states it will write generated content into repository paths (ai/skills/ and docs/extracted/) but does not warn the user that invoking it modifies files. In an agent setting, undisclosed write behavior can cause unintended repository changes, accidental commits of generated content, or overwrite/create files in trusted locations without informed consent.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 87% confidence
Finding: The README instructs users to execute npx add against a remote GitHub URL without pinning to an immutable commit or release. This means future changes to the referenced repository could alter what gets installed, creating a supply-chain risk where users may unknowingly fetch malicious or unintended code.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 83% confidence
Finding: The command npx clawhub@latest install extraction explicitly tracks the latest published package version, which is not reproducible and exposes users to upstream package compromise or malicious updates. Because npx executes fetched package code, an attacker controlling the package or its publishing pipeline could gain code execution on user systems.
Content: No source excerpt is available for this finding.

External Model or Provider Selection

Medium

Category: Excessive Agency
Confidence: 90% confidence
Finding: Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.
Content: Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.
md
--- name: pattern-extraction model: reasoning description: Extract design systems, architecture patterns, and methodology from codebases into reusable skills and documentation. Use when analyzing a project to capture patterns, creating skills from existing code, extracting design tokens, or documenting how a project was built. Triggers on "extract patterns", "extract from this repo", "analyze this codebase", "create skills from this project", "extract design system". ---

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The manifest description contains broad trigger phrases such as 'analyze this codebase' and 'extract from this repo', which can cause the skill to activate in common repository-analysis scenarios beyond the user's specific intent. Because the skill includes file-writing and copy instructions later in the document, over-broad invocation increases the chance of unintended modification guidance being surfaced in ordinary analysis workflows.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 86% confidence
Finding: The installation command uses npx clawhub@latest install extraction, which pulls and executes the latest package version at runtime rather than a pinned, reviewed release. This creates a supply-chain risk: a compromised upstream package or breaking update could execute unexpected code on the user's machine during installation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill instructs creating directories and writing documentation and skill files into the target repository, but it does not require an explicit user warning or confirmation before modifying files. In practice, this can lead an agent to perform repository-changing actions when the user may have expected read-only analysis, risking accidental overwrites, unauthorized changes, or pollution of the codebase.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The staging section recommends copying extracted content into another repository path (/path/to/skills-repo/...) without any warning or approval gate for cross-repository operations. Cross-repo copying raises the risk of unintended data exfiltration, leakage of proprietary code-derived material, or modification of an unrelated repository outside the user's current working scope.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The manifest template uses placeholders like "Use when [WHEN scenarios]" and especially "Triggers on [KEYWORDS]" without requiring specificity, scope limits, or exclusion conditions. This can lead authors to create overly broad trigger descriptions that overlap with normal language, causing unintended skill activation.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.