ClawHub
Back to skill

Security audit

Persona Docs

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward documentation helper for creating product persona docs, with no hidden execution or data exfiltration behavior found.

Before installing, prefer a pinned ClawHub version or a reviewed commit instead of @latest or a mutable GitHub branch. Once installed, expect the skill to read product documentation and create or update persona docs in the repository.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:24
Finding

Unpinned Remote Packages and Repository Content Executed Through npx

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:24, README.md:26, and README.md:32
Vulnerability Type: Supply-chain exposure through mutable, unverified remote dependencies
Risk Level: Medium

Affected code snippets:

SKILL.md:24:

bash
npx clawhub@latest install persona-docs

README.md:26:

bash
npx add https://github.com/wpank/ai/tree/main/skills/writing/persona-docs

README.md:32:

bash
npx clawhub@latest install persona-docs

Technical Analysis

The documented installation procedures use npx, which can download and execute third-party package code with the invoking user's permissions.

The clawhub@latest reference is mutable and can resolve to a different package release after this skill has been reviewed. The GitHub installation command similarly references the mutable main branch rather than an immutable commit. In addition, npx add can resolve and execute the unpinned add package before processing the supplied repository URL.

Consequently, the effective code executed during installation is neither contained in this audited project nor constrained to a cryptographically verified version. A malicious or compromised package release, registry account, GitHub repository, branch, maintainer account, or transitive dependency could alter the installation payload without requiring any modification to this repository.

No evidence establishes that the currently referenced packages or repository are malicious. The vulnerability is the unsafe trust and execution model created by mutable, unverified external dependencies.

Attack Path

  1. An attacker compromises the relevant package registry account, package release process, GitHub maintainer account, repository branch, or a dependency used by the installer.
  2. The attacker publishes malicious code under the mutable latest release or modifies content reachable through the main branch.
  3. A user fo ...[truncated 1057 chars]
Remediation
View remediation

Remediation Suggestions

  1. Replace mutable package tags such as @latest with a reviewed, exact version.
  2. Replace the GitHub main reference with a full immutable commit hash or a verified signed release.
  3. Pin the command runner itself rather than invoking the ambiguous, unpinned add package.
  4. Verify package provenance, checksums, signatures, and registry ownership before installation.
  5. Use lockfiles and integrity metadata where package-manager workflows support them.
  6. Prefer a non-executing manual installation procedure that downloads reviewed files and verifies their checksums before copying them into the destination.
  7. Document that installation should occur without administrator privileges and in an isolated environment with no production credentials.
  8. Periodically review pinned dependencies and update them only after auditing the new versions.

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (7)

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 3)May include surrounding context.

md
# Persona Docs

Create user-centered documentation that defines who a product is for and how they interact with it. Persona docs establish the foundation for product-driven development — every feature decision, design choice, and prioritization call flows from understanding your users.

## What's Inside

Rp1

Medium
Category
MCP Rug Pull
Confidence
89% confidence
Finding

The README instructs users to execute npx add against a remote GitHub URL without pinning a specific immutable version or commit. That allows supply-chain drift: if the upstream package or repository changes, users may unknowingly run different code than intended, including potentially malicious installer logic.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
92% confidence
Finding

Using npx clawhub@latest install persona-docs pulls and executes the latest published code at runtime, which is not reproducible and increases exposure to dependency hijacking or malicious updates. Because npx executes fetched packages, a compromised publisher account or package update could directly affect users running the command.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
85% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 57)May include surrounding context.

From your project root:

bash
mkdir -p .claude/skills
cp -r ~/.ai-skills/skills/writing/persona-docs .claude/skills/persona-docs

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
85% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 64)May include surrounding context.

Claude Code (global)

bash
mkdir -p ~/.claude/skills
cp -r ~/.ai-skills/skills/writing/persona-docs ~/.claude/skills/persona-docs

External Model or Provider Selection

Medium
Category
Excessive Agency
Confidence
90% confidence
Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md
---
name: persona-docs
model: reasoning
version: 1.0.0
description: >
  Create persona documentation for a product or codebase. Use when asked to create persona docs,

Rp1

Medium
Category
MCP Rug Pull
Confidence
90% confidence
Finding

The installation command uses npx clawhub@latest, which fetches and executes the newest published package version at runtime rather than a reviewed, fixed version. If the package is compromised upstream or a breaking/malicious release is published, users running the documented command could execute untrusted code on their machine.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.