Production Readiness

• Outcome: Review
• Latest audit: Sep 10, 2026 · 4:37 PM UTC
• Version: 1.0.0

Overview

The skill is a coherent production-readiness reviewer, but its install instructions use mutable remote npm and GitHub sources that can change after review.

Review or pin the installer sources before running the documented npx commands, preferably using a fixed clawhub version and immutable Git commit or release tag. Once installed from a trusted source, the skill's own content is a checklist-style orchestration guide, but it will ask the agent to consult other named skills during a production-readiness review.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:16
• Finding: Mutable ClawHub Package Executed Through npx## Vulnerability Details **File Location**: `SKILL.md:16-18` **Vulnerability Type**: Unpinned third-party installation dependency **Risk Level**: Medium **Vulnerable Code**: ```bash npx clawhub@latest install production-readiness ``` ### Technical Analysis The installation procedure instructs users to execute the mutable `latest` release of the third-party `clawhub` package through `npx`. Because `@latest` is controlled by the package registry and can resolve to different code over time, the code executed during installation is not the same immutable artifact that was available when this skill was audited. `npx` may download and execute the selected package immediately. Consequently, compromise of the package publisher, registry account, release process, or package itself could cause arbitrary attacker-controlled code to run during installation. No exact package version, integrity hash, lockfile, or other artifact-verification mechanism is specified. ### Attack Path 1. An attacker compromises the `clawhub` package, its publisher account, or its release pipeline. 2. The attacker publishes a malicious version and assigns or causes the registry to assign the `latest` distribution tag to it. 3. A user follows the documented installation command. 4. `npx` retrieves the package currently referenced by `clawhub@latest`. 5. The malicious package CLI or applicable lifecycle behavior executes with the privileges of the user running the command. 6. The payload could access files, credentials, environment variables, and network resources available to that user. ### Impact Assessment Successful exploitation could provide arbitrary code execution under the installing user's account. The accessible scope may include the current project, user-owned files, developer credentials, environment variables, SSH configuration, package registry tokens, and reachable internal services. If the command is run from a privileged account or CI/CD ...[truncated 301 chars]
• Remediation: ## Remediation Suggestions - Replace `@latest` with an explicitly reviewed, exact package version. - Verify the resolved package and its transitive dependencies before recommending execution. - Publish and validate a cryptographic integrity hash or signed provenance for the approved artifact. - Document a secure installation process that prevents silent upgrades. - Prefer a lockfile-backed installation workflow where applicable. - Execute installation with the least-privileged account possible and avoid running it with administrator or root privileges. - Establish a controlled update process in which each new package version is reviewed before the documented pin is changed.

T08 · Insecure Dependencies

Warning

• Location: README.md:22
• Finding: README Installation Commands Execute Unpinned Remote Packages## Vulnerability Details **File Location**: `README.md:22-30` **Vulnerability Type**: Mutable npm and repository installation sources **Risk Level**: Medium **Vulnerable Code**: ```bash npx add https://github.com/wpank/ai/tree/main/skills/meta/production-readiness ``` ```bash npx clawhub@latest install production-readiness ``` ### Technical Analysis The README presents two installation paths that depend on mutable external content. The first command invokes `add` through `npx` without specifying an exact package version, while its source argument references the mutable GitHub `main` branch rather than an immutable commit. The effective installation chain can therefore change when either the npm-delivered command or repository branch changes. The second command explicitly executes the mutable `latest` version of `clawhub`. Neither path provides a package version pin, Git commit hash, integrity digest, signature-verification procedure, or lockfile. These commands create a supply-chain trust boundary: code obtained at installation time may differ from the content reviewed in this audit. If an upstream package, publisher account, repository, or release pipeline is compromised, the documented commands could retrieve or execute attacker-controlled content. ### Attack Path **GitHub installation path:** 1. An attacker compromises the unpinned `add` package, its publisher, or the referenced GitHub repository. 2. The attacker publishes malicious package code or modifies content on the mutable `main` branch. 3. A user copies and executes the README command. 4. `npx` resolves and executes the current version of `add`. 5. The installer consumes the current repository content and may place attacker-controlled files into the user's skill environment. 6. Malicious installer behavior or subsequently loaded skill content executes within the user's development or agent environment. **ClawHub installation path:** 1. An ...[truncated 935 chars]
• Remediation: ## Remediation Suggestions - Pin the `add` and `clawhub` packages to exact, reviewed versions. - Replace the GitHub `main` branch URL with an immutable, reviewed commit hash or signed release tag. - Provide expected cryptographic checksums or signed provenance and require verification before installation. - Use lockfiles or an equivalent dependency-resolution record to pin transitive dependencies. - Avoid installation commands that immediately execute unreviewed remote packages. - Document the exact approved package versions, repository commit, and verification procedure. - Review upstream updates before changing any pinned version or commit. - Recommend installation under a least-privileged account and prohibit privileged execution unless strictly necessary.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (7)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence
• Finding: The README instructs users to run `npx add` against a GitHub URL without pinning to a specific immutable version, tag, or commit. That creates a supply-chain risk: future changes to the remote package or installer behavior could cause users to fetch and execute different code than what was originally reviewed.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence
• Finding: Using `npx clawhub@latest install production-readiness` relies on the moving `latest` tag, which can change at any time and cause execution of newly published code without review. In an installation context, this is a real supply-chain exposure because `npx` may download and run package code immediately.

Session Persistence

Medium

• Category: Rogue Agent

Content

From your project root:

```bash
mkdir -p .cursor/skills
cp -r ~/.ai-skills/skills/meta/production-readiness .cursor/skills/production-readiness
```

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

From your project root:

```bash
mkdir -p .claude/skills
cp -r ~/.ai-skills/skills/meta/production-readiness .claude/skills/production-readiness
```

• Confidence: 85% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

#### Claude Code (global)

```bash
mkdir -p ~/.claude/skills
cp -r ~/.ai-skills/skills/meta/production-readiness ~/.claude/skills/production-readiness
```

• Confidence: 85% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

External Model or Provider Selection

Medium

• Category: Excessive Agency

Content

---
name: production-readiness
model: reasoning
description: Meta-skill that orchestrates logging, monitoring, error handling, performance, security, deployment, and testing skills to ensure a service is fully production-ready before launch. Use before first deploy, major releases, quarterly reviews, or after incidents.
---

• Confidence: 90% confidence
• Finding: Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 89% confidence
• Finding: The installation command uses `npx clawhub@latest`, which fetches and executes the newest published package version at runtime rather than a reviewed, pinned release. That creates a supply-chain risk: a compromised publisher account, malicious new release, or breaking change could cause users to run untrusted code during installation.

Static analysis

No suspicious patterns detected.