ClawHub
Back to skill

Security audit

Financial Design Systems

Security checks for vulnerabilities and agentic risk

Overview

The skill itself is a chart-design reference, but its recommended installer can fetch and run changing remote code, so it should be reviewed before installation.

Review or avoid the one-line `npx add` install path unless you trust the remote repository and installer at install time. Prefer installing from a pinned commit or verified release, and be aware that global Cursor or Claude installation makes the skill available in future sessions.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
README.md:27
Finding

Unpinned Package Execution and Mutable Remote Skill Installation

Content
View full analysis

Vulnerability Details

File Location: README.md, line 27
Vulnerability Type: Supply-chain risk from an unpinned executable package and mutable remote source
Risk Level: Medium

Vulnerable Code

bash
npx add https://github.com/wpank/ai/tree/main/skills/design-systems/financial-data-visualization

Technical Analysis

The installation command invokes npx add without pinning the add npm package to a reviewed version or verifying its integrity. If the package is absent from the local cache, npx can retrieve the currently resolved release and execute its command-line code with the invoking user's privileges.

The command also refers to the mutable main branch of an external GitHub repository rather than a reviewed commit SHA. Consequently, the installed skill content can change after this project has been audited. These two mutable trust points prevent users from reliably reproducing or verifying the audited installation.

No evidence establishes that the current npm package or repository content is malicious. The vulnerability is the unsafe trust and execution model presented by the documented installation procedure.

Attack Path

  1. An attacker compromises the unpinned npm package, its maintainer account, or its publication pipeline; alternatively, the referenced GitHub repository or branch is compromised.
  2. The attacker publishes malicious package behavior or modifies the skill content reachable through the mutable main branch.
  3. A user follows the documented installation command.
  4. npx resolves and executes the package version available at installation time.
  5. The installer retrieves content that may differ from the version reviewed in this audit.
  6. Malicious installer code can run under the user's account, or altered skill instructions can be placed into the user's agent skill directory and affect later sessions.

Impact Assessment

Successful exploitation of the npx execution stage could run arbitrary co ...[truncated 587 chars]

Remediation
View remediation

Remediation Suggestions

  1. Replace the ambiguous npx add invocation with a known, explicitly named installer pinned to an exact reviewed version.
  2. Pin the remote repository reference to a reviewed commit SHA rather than main.
  3. Verify downloaded artifacts using a published cryptographic checksum or package-manager integrity metadata before installation.
  4. Avoid executing a downloaded installer where a non-executable download-and-copy workflow is sufficient.
  5. Document the exact expected files and hashes so users can verify that installed content matches the audited release.
  6. Run any unavoidable installer with minimal privileges and without unnecessary credentials in its environment.
  7. Prefer a signed, immutable release artifact from a controlled distribution channel.

A safer workflow should conceptually follow this pattern:

bash
# Download an immutable, reviewed release artifact.
# Verify its published SHA-256 checksum.
# Extract and copy only the expected README.md and SKILL.md files.

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (6)

Rp1

Medium
Category
MCP Rug Pull
Confidence
90% confidence
Finding

The README instructs users to install the skill directly from a remote GitHub URL using npx add without any pinned version, commit, or integrity control. This creates a supply-chain risk because the referenced content can change over time, causing users to fetch and trust different code or artifacts than originally reviewed.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 35)May include surrounding context.

From your project root:

bash
mkdir -p .cursor/skills
cp -r ~/.ai-skills/skills/design-systems/financial-data-visualization .cursor/skills/financial-data-visualization

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
85% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 51)May include surrounding context.

From your project root:

bash
mkdir -p .claude/skills
cp -r ~/.ai-skills/skills/design-systems/financial-data-visualization .claude/skills/financial-data-visualization

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
85% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 58)May include surrounding context.

Claude Code (global)

bash
mkdir -p ~/.claude/skills
cp -r ~/.ai-skills/skills/design-systems/financial-data-visualization ~/.claude/skills/financial-data-visualization

External Model or Provider Selection

Medium
Category
Excessive Agency
Confidence
90% confidence
Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md
---
name: financial-data-visualization
model: standard
description: Patterns for building dark-themed financial charts and data visualizations. Covers chart theming, color scales for gains/losses, and real-time data display. Use when building trading dashboards or financial analytics. Triggers on chart theme, data visualization, financial chart, dark theme, gains losses, trading UI.
---

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The manifest description says the skill 'Triggers on chart theme, data visualization, financial chart, dark theme, gains losses, trading UI.' Several of these phrases, especially 'chart theme' and 'data visualization,' are broad and could overlap with many general design requests rather than narrowly identifying this specific skill. The file does not provide exclusion conditions or more precise trigger boundaries.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.