ClawHub
Back to skill

Security audit

Microservice Patterns

Security checks for vulnerabilities and agentic risk

Overview

This is a documentation-only microservices guidance skill; the main caution is its unpinned install command, not malicious behavior in the reviewed artifact.

Review the skill normally before installing. Prefer a pinned commit or trusted installer path instead of the README's mutable main-branch npx command, especially on machines with production credentials. The reviewed skill content itself is informational and does not request sensitive access.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
README.md:27
Finding

Unpinned npm Installer and Mutable Remote Skill Source

Content
View full analysis

Vulnerability Details

File Location: README.md, lines 27-29
Vulnerability Type: Supply-chain exposure through unpinned executable and mutable remote source
Risk Level: Medium

Vulnerable Code

bash
npx add https://github.com/wpank/ai/tree/main/skills/backend/microservices-patterns

Technical Analysis

The documented installation command invokes npx without pinning the add package to an exact, reviewed version. Depending on the local npm environment and cache state, npx can retrieve and execute that package dynamically. The effective installer implementation can therefore differ from the implementation that was available when this project was audited.

The skill is also retrieved from the mutable main branch of a remote GitHub repository. No immutable commit identifier, checksum, package integrity value, or signature is specified. A later upstream modification or compromise could consequently alter the content installed by the same documented command.

This is a supply-chain weakness rather than evidence that the currently referenced package or repository is malicious. The risk arises because trust is delegated to mutable third-party resources at installation time without integrity verification.

Attack Path

  1. An attacker compromises the npm package used by npx, the package publisher account, the referenced GitHub account, or the upstream repository.
  2. The attacker publishes a modified installer version or changes content reachable through the repository's main branch.
  3. A user follows the installation command from README.md.
  4. npx retrieves and executes the unpinned installer, which then processes content from the mutable remote source.
  5. Malicious installer code could execute under the user's account, or modified skill instructions could be placed in the user's agent configuration.
  6. The resulting access is limited by the privileges of the user running the command, bu ...[truncated 842 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin the installer to an exact, reviewed npm package version rather than invoking an unspecified version:
    bash
    npx --yes add@<reviewed-version> <immutable-source>
  2. Confirm that add is the intended and trusted installer package. Prefer a purpose-specific installer with documented ownership and provenance.
  3. Reference an immutable Git commit instead of the mutable main branch.
  4. Publish and verify a cryptographic checksum or signed release artifact before installation.
  5. Use npm lockfiles and integrity metadata where installation occurs within a managed project.
  6. Avoid executing remote installers where a non-executable download-and-review workflow is sufficient. Download the skill at a pinned revision, inspect it, and copy the reviewed files into the target directory.
  7. Run installation with an unprivileged account in an isolated environment that does not expose production credentials.
  8. Document the expected package digest, repository commit, and installed file list so users can verify provenance and detect upstream changes.

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (5)

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 36)May include surrounding context.

From your project root:

bash
mkdir -p .cursor/skills
cp -r ~/.ai-skills/skills/backend/microservices-patterns .cursor/skills/microservices-patterns

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
85% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 52)May include surrounding context.

From your project root:

bash
mkdir -p .claude/skills
cp -r ~/.ai-skills/skills/backend/microservices-patterns .claude/skills/microservices-patterns

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
85% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 59)May include surrounding context.

Claude Code (global)

bash
mkdir -p ~/.claude/skills
cp -r ~/.ai-skills/skills/backend/microservices-patterns ~/.claude/skills/microservices-patterns

External Model or Provider Selection

Medium
Category
Excessive Agency
Confidence
90% confidence
Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md
---
name: microservices-patterns
model: reasoning
---

# Microservices Patterns

Static analysis

No suspicious patterns detected.