ClawHub
Back to skill

Security audit

Production Readiness

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent production-readiness reviewer, but its install instructions use mutable remote npm and GitHub sources that can change after review.

Review or pin the installer sources before running the documented npx commands, preferably using a fixed clawhub version and immutable Git commit or release tag. Once installed from a trusted source, the skill's own content is a checklist-style orchestration guide, but it will ask the agent to consult other named skills during a production-readiness review.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:16
Finding

Mutable ClawHub Package Executed Through npx

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:16-18
Vulnerability Type: Unpinned third-party installation dependency
Risk Level: Medium

Vulnerable Code:

bash
npx clawhub@latest install production-readiness

Technical Analysis

The installation procedure instructs users to execute the mutable latest release of the third-party clawhub package through npx. Because @latest is controlled by the package registry and can resolve to different code over time, the code executed during installation is not the same immutable artifact that was available when this skill was audited.

npx may download and execute the selected package immediately. Consequently, compromise of the package publisher, registry account, release process, or package itself could cause arbitrary attacker-controlled code to run during installation. No exact package version, integrity hash, lockfile, or other artifact-verification mechanism is specified.

Attack Path

  1. An attacker compromises the clawhub package, its publisher account, or its release pipeline.
  2. The attacker publishes a malicious version and assigns or causes the registry to assign the latest distribution tag to it.
  3. A user follows the documented installation command.
  4. npx retrieves the package currently referenced by clawhub@latest.
  5. The malicious package CLI or applicable lifecycle behavior executes with the privileges of the user running the command.
  6. The payload could access files, credentials, environment variables, and network resources available to that user.

Impact Assessment

Successful exploitation could provide arbitrary code execution under the installing user's account. The accessible scope may include the current project, user-owned files, developer credentials, environment variables, SSH configuration, package registry tokens, and reachable internal services. If the command is run from a privileged account or CI/CD ...[truncated 301 chars]

Remediation
View remediation

Remediation Suggestions

  • Replace @latest with an explicitly reviewed, exact package version.
  • Verify the resolved package and its transitive dependencies before recommending execution.
  • Publish and validate a cryptographic integrity hash or signed provenance for the approved artifact.
  • Document a secure installation process that prevents silent upgrades.
  • Prefer a lockfile-backed installation workflow where applicable.
  • Execute installation with the least-privileged account possible and avoid running it with administrator or root privileges.
  • Establish a controlled update process in which each new package version is reviewed before the documented pin is changed.

T08 · Insecure Dependencies

Warning
Location
README.md:22
Finding

README Installation Commands Execute Unpinned Remote Packages

Content
View full analysis

Vulnerability Details

File Location: README.md:22-30
Vulnerability Type: Mutable npm and repository installation sources
Risk Level: Medium

Vulnerable Code:

bash
npx add https://github.com/wpank/ai/tree/main/skills/meta/production-readiness
bash
npx clawhub@latest install production-readiness

Technical Analysis

The README presents two installation paths that depend on mutable external content.

The first command invokes add through npx without specifying an exact package version, while its source argument references the mutable GitHub main branch rather than an immutable commit. The effective installation chain can therefore change when either the npm-delivered command or repository branch changes.

The second command explicitly executes the mutable latest version of clawhub. Neither path provides a package version pin, Git commit hash, integrity digest, signature-verification procedure, or lockfile.

These commands create a supply-chain trust boundary: code obtained at installation time may differ from the content reviewed in this audit. If an upstream package, publisher account, repository, or release pipeline is compromised, the documented commands could retrieve or execute attacker-controlled content.

Attack Path

GitHub installation path:

  1. An attacker compromises the unpinned add package, its publisher, or the referenced GitHub repository.
  2. The attacker publishes malicious package code or modifies content on the mutable main branch.
  3. A user copies and executes the README command.
  4. npx resolves and executes the current version of add.
  5. The installer consumes the current repository content and may place attacker-controlled files into the user's skill environment.
  6. Malicious installer behavior or subsequently loaded skill content executes within the user's development or agent environment.

ClawHub installation path:

  1. An ...[truncated 935 chars]
Remediation
View remediation

Remediation Suggestions

  • Pin the add and clawhub packages to exact, reviewed versions.
  • Replace the GitHub main branch URL with an immutable, reviewed commit hash or signed release tag.
  • Provide expected cryptographic checksums or signed provenance and require verification before installation.
  • Use lockfiles or an equivalent dependency-resolution record to pin transitive dependencies.
  • Avoid installation commands that immediately execute unreviewed remote packages.
  • Document the exact approved package versions, repository commit, and verification procedure.
  • Review upstream updates before changing any pinned version or commit.
  • Recommend installation under a least-privileged account and prohibit privileged execution unless strictly necessary.

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (7)

Rp1

Medium
Category
MCP Rug Pull
Confidence
97% confidence
Finding

The README instructs users to run npx add against a GitHub URL without pinning to a specific immutable version, tag, or commit. That creates a supply-chain risk: future changes to the remote package or installer behavior could cause users to fetch and execute different code than what was originally reviewed.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
96% confidence
Finding

Using npx clawhub@latest install production-readiness relies on the moving latest tag, which can change at any time and cause execution of newly published code without review. In an installation context, this is a real supply-chain exposure because npx may download and run package code immediately.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 41)May include surrounding context.

From your project root:

bash
mkdir -p .cursor/skills
cp -r ~/.ai-skills/skills/meta/production-readiness .cursor/skills/production-readiness

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
85% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 57)May include surrounding context.

From your project root:

bash
mkdir -p .claude/skills
cp -r ~/.ai-skills/skills/meta/production-readiness .claude/skills/production-readiness

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
85% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 64)May include surrounding context.

Claude Code (global)

bash
mkdir -p ~/.claude/skills
cp -r ~/.ai-skills/skills/meta/production-readiness ~/.claude/skills/production-readiness

External Model or Provider Selection

Medium
Category
Excessive Agency
Confidence
90% confidence
Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md
---
name: production-readiness
model: reasoning
description: Meta-skill that orchestrates logging, monitoring, error handling, performance, security, deployment, and testing skills to ensure a service is fully production-ready before launch. Use before first deploy, major releases, quarterly reviews, or after incidents.
---

Rp1

Medium
Category
MCP Rug Pull
Confidence
89% confidence
Finding

The installation command uses npx clawhub@latest, which fetches and executes the newest published package version at runtime rather than a reviewed, pinned release. That creates a supply-chain risk: a compromised publisher account, malicious new release, or breaking change could cause users to run untrusted code during installation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.