T08 · Insecure Dependencies
Warning
- Location
README.md:27- Finding
Unpinned npx Installers Retrieve and Execute Mutable Third-Party Content
- Content
View full analysis
- Remediation
View remediation
Security audit
Native UI
Security checks for vulnerabilities and agentic risk
Overview
This is a coherent Expo/React Native UI guidance skill, with install and privacy best-practice caveats but no evidence of hidden, deceptive, destructive, or exfiltrating behavior.
Install from a pinned ClawHub version or reviewed commit when possible, and review generated media code so camera and microphone permissions are requested only after a clear user action. Use the WebGPU/native-build guidance only for projects that actually need custom native graphics support.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T08 · Insecure Dependencies
Note
- Location
references/webgpu-three.md:21- Finding
Peer-Dependency Validation Is Bypassed for Native WebGPU Dependencies
- Content
View full analysis
--legacy-peer-deps ``` ### Technical Analysis The documented installation command combines permissive caret ranges with `--legacy-peer-deps`. Caret ranges allow npm to select later compatible releases that were not necessarily included in the original review. The `--legacy-peer-deps` option additionally suppresses npm's peer-dependency compatibility enforcement. Peer-dependency conflicts can indicate that packages expect incompatible versions or runtime contracts. Ignoring these conflicts can produce an unreviewed dependency graph containing incompatible native modules. It also reduces the effectiveness of dependency-resolution safeguards when a compromised or unexpectedly changed package version falls within an allowed range. The audited documentation identifies exact tested versions conceptually, but the actual command does not pin every runtime package exactly and encourages bypassing peer validation. No malicious dependency was confirmed. ### Attack Path 1. A later package version is published within one of the permitted caret ranges, or a publisher account is compromised. 2. A developer runs the documented command without a lockfile that fixes the previously reviewed dependency graph. 3. npm resolves the newer package or transitive dependency. 4. Peer-dependency conflicts that might otherwise block or ...[truncated 885 chars]- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
Findings (17)
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 90% confidence
- Finding
The README instructs users to run a remote package/install command via
npx addagainst a GitHub URL without pinning to an immutable version, tag, or commit. That creates a supply-chain risk because the referenced content can change over time, causing future installs to execute or fetch different code than originally reviewed.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 93% confidence
- Finding
Using
npx clawhub@latest install native-uipulls and executes the latest version of the installer at runtime, which is mutable and could introduce unreviewed behavior if the package is compromised or updated unexpectedly. This is a classic supply-chain exposure because the command trusts whatever code is current at execution time.- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
From your project root:
bash mkdir -p .cursor/skills cp -r ~/.ai-skills/skills/frontend/native-ui .cursor/skills/native-ui
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 85% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
From your project root:
bash mkdir -p .claude/skills cp -r ~/.ai-skills/skills/frontend/native-ui .claude/skills/native-ui
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 85% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
Claude Code (global)
bash mkdir -p ~/.claude/skills cp -r ~/.ai-skills/skills/frontend/native-ui ~/.claude/skills/native-ui
External Model or Provider Selection
Medium
- Category
- Excessive Agency
- Confidence
- 90% confidence
- Finding
Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.
- Content
md --- name: native-ui model: standard version: 1.0.0 description: > Building native mobile UIs with Expo Router and React Native. Covers routing,
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
The installation command uses
npx clawhub@latest install native-ui, which fetches and executes the latest published package code at runtime. Unlike the Expo examples, this directly installs the skill through a third-party package and increases supply-chain risk if the package is compromised, typosquatted, or updated maliciously.- Content
Behavior Manipulation
Medium
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Subtle instructions detected that may alter agent decision-making or introduce hidden biases.
- Content
md ## Best Practices - Always use SF Symbols over vector icon libraries - Match symbol weight to nearby text weight - Use `.fill` variants for selected/active states - Use PlatformColor for tint to support dark mode
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The guidance explicitly recommends requesting camera permission eagerly, which can normalize prompting for sensitive access before clear user intent is established. In a mobile UI skill, this is risky because downstream developers may copy the pattern and collect camera access earlier than necessary, degrading privacy expectations and increasing the chance of overbroad data access.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The microphone example requests recording permission automatically on component mount, before the user explicitly chooses to record. This is dangerous because microphone access is highly sensitive, and permission prompts triggered without user action can surprise users, encourage dark-pattern implementations, and lead developers to request recording capability more broadly than necessary.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The instruction to use this skill for 'ANY 3D graphics, games, GPU compute, or Three.js features' is extremely broad and can cause the agent to invoke the skill in contexts it was not carefully scoped for. Over-broad activation increases the chance of irrelevant or unsafe guidance being applied automatically, especially because the skill includes forceful configuration changes, custom native setup, and build commands.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
The line says to 'Never use FontAwesome or Ionicons,' which is a hard natural-language prohibition on tooling choice. While not a security issue, it is a policy-like constraint stated categorically and may be inappropriate if different platforms, accessibility needs, or project contexts require alternatives and no exception path is documented.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The instruction says to "Always prefer NativeTabs ... for the best iOS experience," which imposes a fixed platform-specific choice in natural language rather than offering a user or project-context choice. This can be read as forcing a specific platform-oriented preference instead of allowing locale/platform needs to be selected explicitly.
- Content
Static analysis
No suspicious patterns detected.