Full Stack Feature

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 4:37 PM UTC
• Version: 1.0.0

Overview

This skill is a disclosed feature-development workflow guide, but its install instructions use mutable remote sources that users should pin before running.

Review and pin the installer before use: prefer a fixed clawhub version or immutable Git commit instead of @latest or a mutable branch. Once installed, expect this skill to guide an agent through broad codebase changes for feature work, so use it in a repository where you are comfortable allowing user-directed implementation, testing, and documentation edits.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:16

Finding

Unpinned Remote Dependencies Executed Through npx

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:16-18, README.md:24-32
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code

SKILL.md:16-18:

bash

npx clawhub@latest install full-stack-feature

README.md:24-32:

bash

npx add https://github.com/wpank/ai/tree/main/skills/meta/full-stack-feature

bash

npx clawhub@latest install full-stack-feature

Technical Analysis

The documented installation procedures use npx to download and execute remote npm packages without immutable version or integrity constraints. In particular, clawhub@latest explicitly selects a mutable package release. The npx add command also invokes a remotely resolved npm package while passing a GitHub source located on a mutable branch.

No exact package version, Git commit hash, package-lock constraint, integrity checksum, or cryptographic signature is provided. Consequently, the code executed by these commands can change after this skill has been reviewed. If the npm package, publisher account, release process, or referenced GitHub repository is compromised, an attacker could distribute modified installer code to subsequent users.

This is a supply-chain risk rather than evidence that the currently referenced packages are malicious.

Attack Path

1. An attacker compromises the npm publisher account, package release pipeline, or GitHub repository referenced by the documentation.
2. The attacker publishes a malicious package version selected by @latest, modifies the mutable repository branch, or otherwise alters a remotely resolved installer dependency.
3. A user follows one of the documented installation commands.
4. npx downloads the changed package and executes its command or applicable lifecycle behavior with the user's privileges.
5. The malicious installer can perform actions available to that user, such as modifying project or user files, reading acc ...[truncated 748 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace clawhub@latest with an explicitly reviewed, immutable package version.
2. Pin repository-based installation to a specific Git commit rather than a mutable branch such as main.
3. Publish and verify integrity checksums or cryptographic signatures for distributed artifacts.
4. Document the expected package publisher, source repository, version, and checksum so users can verify provenance before installation.
5. Prefer a reviewed local or manual installation method when feasible.
6. In CI environments, use lockfiles, approved registries, dependency allowlists, and restricted credentials.
7. Run installation in a sandbox or least-privileged environment without unrelated secrets.
8. Review installer and lifecycle scripts for every dependency update before changing the pinned version.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence

Finding

The README instructs users to run npx add against a GitHub URL without pinning to an immutable version, tag, or commit. That creates a supply-chain risk because future changes to the referenced repository can alter what gets installed, so users may execute unreviewed or malicious content later even if the current repository state is benign.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 89% confidence

Finding

Using npx clawhub@latest install full-stack-feature pulls and executes the latest package version at runtime, which is mutable and may change without notice. If the package or its dependency chain is compromised, users can be exposed to arbitrary code execution during installation.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 41)May include surrounding context.

From your project root:

bash

mkdir -p .cursor/skills
cp -r ~/.ai-skills/skills/meta/full-stack-feature .cursor/skills/full-stack-feature

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 57)May include surrounding context.

From your project root:

bash

mkdir -p .claude/skills
cp -r ~/.ai-skills/skills/meta/full-stack-feature .claude/skills/full-stack-feature

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 64)May include surrounding context.

Claude Code (global)

bash

mkdir -p ~/.claude/skills
cp -r ~/.ai-skills/skills/meta/full-stack-feature ~/.claude/skills/full-stack-feature

External Model or Provider Selection

Medium

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: full-stack-feature
model: reasoning
description: Meta-skill for orchestrating end-to-end feature development from persona research through deployed, tested code — coordinating skills, commands, and agents across every stage. Use when building a new feature end-to-end, coordinating frontend + backend work, or needing a structured approach from research to production.
---

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

The installation command uses npx clawhub@latest, which pulls whatever version is current at execution time rather than a reviewed, fixed release. That creates a supply-chain risk: a compromised or breaking upstream release could be executed by users immediately, and because this is an install path in a meta-skill, it is likely to be copied and run as-is.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.