ClawHub
Back to skill

Security audit

Logging Observability

Security checks for vulnerabilities and agentic risk

Overview

The skill content is ordinary observability guidance, but its recommended npx installer fetches mutable remote code that may run with the user's local privileges.

Review the skill as documentation, but avoid the unpinned `npx add` installer unless you can verify the exact package and source. Prefer a pinned commit or manual installation of the reviewed files, and adapt the logging/tracing examples so user identifiers, secrets, request bodies, and business data are redacted before leaving your environment.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
README.md:29
Finding

Unpinned Third-Party Package Execution During Installation

Content
View full analysis

Vulnerability Details

File Location: README.md, line 29
Vulnerability Type: Supply-chain risk caused by unpinned remote package execution
Risk Level: Medium

Vulnerable Code:

bash
npx add https://github.com/wpank/ai/tree/main/skills/tools/logging-observability

Technical Analysis

In standard npx command syntax, add is resolved as the package or executable to download and run. The command does not pin that package to an exact version or verify its integrity. Consequently, the code executed at installation time may differ from the code reviewed in this project.

The supplied GitHub URL also references a mutable branch path rather than an immutable commit. Both the executable package resolution and the requested repository content therefore depend on externally controlled, changeable sources.

This creates a supply-chain execution risk: if the resolved npm package, its transitive dependencies, its publisher account, or the mutable upstream repository is compromised, following the documented installation command could execute attacker-controlled code. The actual installer implementation is not included in the audited project, so its behavior cannot be verified from the available files.

Attack Path

  1. An attacker compromises or maliciously updates the npm package resolved as add, one of its executable dependencies, or the referenced mutable upstream source.
  2. A user follows the installation instructions in README.md.
  3. npx resolves and downloads the unpinned package from the configured npm registry.
  4. The downloaded package and any applicable lifecycle or command logic execute with the privileges of the user running npx.
  5. Malicious code can access resources available to that user, modify local files, invoke network services, or install altered Skill content.

Impact Assessment

Successful exploitation permits arbitrary code execution with the privileges of the user perf ...[truncated 576 chars]

Remediation
View remediation

Remediation Suggestions

  1. Replace the ambiguous npx add ... command with a documented installer whose package name and purpose are explicit.
  2. Pin every executable npm dependency to an exact reviewed version rather than a tag or version range.
  3. Commit and enforce package lockfiles and integrity metadata where package installation is required.
  4. Pin repository sources to a full immutable commit hash rather than a branch path.
  5. Prefer a non-executable installation method, such as cloning a pinned commit and copying the reviewed Skill directory, when no installer logic is necessary.
  6. Document the expected package publisher and registry, and verify package provenance or signatures before execution.
  7. Run any unavoidable installer in a restricted environment with minimal filesystem access, no unnecessary credentials, and no administrative privileges.
  8. Update the installation documentation to show the exact expected artifact and checksum so users can verify it before use.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
Findings (8)

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The README instructs users to install via npx add from a GitHub URL without any pinned version, commit, or integrity control. This creates a supply-chain risk because the referenced content can change over time, causing future installations to fetch different code than was originally reviewed.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 38)May include surrounding context.

From your project root:

bash
mkdir -p .cursor/skills
cp -r ~/.ai-skills/skills/tools/logging-observability .cursor/skills/logging-observability

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
85% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 54)May include surrounding context.

From your project root:

bash
mkdir -p .claude/skills
cp -r ~/.ai-skills/skills/tools/logging-observability .claude/skills/logging-observability

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
85% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 61)May include surrounding context.

Claude Code (global)

bash
mkdir -p ~/.claude/skills
cp -r ~/.ai-skills/skills/tools/logging-observability ~/.claude/skills/logging-observability

External Model or Provider Selection

Medium
Category
Excessive Agency
Confidence
90% confidence
Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md
---
name: logging-observability
model: standard
description: Structured logging, distributed tracing, and metrics collection patterns for building observable systems. Use when implementing logging infrastructure, setting up distributed tracing with OpenTelemetry, designing metrics collection (RED/USE methods), configuring alerting and dashboards, or reviewing observability practices. Covers structured JSON logging, context propagation, trace sampling, Prometheus/Grafana stack, alert design, and PII/secret scrubbing.
version: 1.0.0
---

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The middleware example places user_id into request context that is intended to be inherited by downstream logs, creating a realistic path for persistent logging of user-linked identifiers. While the document later warns against logging PII, it does not explicitly qualify user_id as sensitive or instruct minimization, hashing, or policy controls for when identity fields may appear in logs and traces.

Content

No source excerpt is available for this finding.

Behavior Manipulation

Medium
Category
Prompt Injection
Confidence
70% confidence
Finding

Subtle instructions detected that may alter agent decision-making or introduce hidden biases.

Content

Scanner excerpt · SKILL.md (reported line 92)May include surrounding context.

OpenTelemetry Setup

Always prefer OpenTelemetry over vendor-specific SDKs:

typescript
import { NodeSDK } from '@opentelemetry/sdk-node';

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The OpenTelemetry example configures export of traces to a collector over HTTP and encourages broad instrumentation, but does not warn that spans and attributes can carry sensitive business or user data into external observability systems. In practice, teams may copy this setup and export request metadata, exception messages, or custom attributes without sanitization or transport hardening.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.