T08 · Insecure Dependencies
Warning
- Location
SKILL.md:15- Finding
Unpinned ClawHub Package Execution During Installation
- Content
View full analysis
- Remediation
View remediation
Security audit
Professional Communication
Security checks for vulnerabilities and agentic risk
Overview
This is a professional writing helper with no hidden code or data access, though its install commands should be treated with normal supply-chain caution.
Install only from a source and version you trust, preferably pinned to a reviewed release or commit. Before sending generated messages, review recipients and redact secrets, customer data, internal-only links, and sensitive incident details; record meetings only when allowed by policy and applicable consent rules.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T08 · Insecure Dependencies
Warning
- Location
README.md:16- Finding
Unpinned Remote Packages and Mutable Repository Content in README Installation Commands
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (13)
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md # Professional Communication Write clear, effective professional messages that get read and acted upon. Routes you to ready-to-use templates and translation guides for professional technical communication. ## What's Inside
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
The description states that the skill routes users to 'translation guides for professional technical communication,' but does not indicate any user choice or opt-in around language or locale. Because language-related behavior is mentioned in natural language without documented choice or justification, this may conflict with locale/language policy expectations.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
This markdown file describes invocation context with very broad phrases such as 'Writing Slack/Teams messages' and 'Any written communication to teammates, managers, or stakeholders.' Without narrower trigger constraints or exclusion examples, the skill could be matched to common everyday writing tasks far beyond a specific, well-bounded use case.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 92% confidence
- Finding
The README instructs users to run
npx addagainst a remote GitHub URL without pinning to a specific immutable version, commit, or digest. That creates a supply-chain risk: if the remote content changes or the upstream repository is compromised, users may install unexpected code.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 95% confidence
- Finding
Using
npx clawhub@latest install professional-communicationpulls and executes the latest published package version, which is mutable over time. If the package is compromised or a malicious version is published, users could execute attacker-controlled code during installation.- Content
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 85% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
From your project root:
bash mkdir -p .claude/skills cp -r ~/.ai-skills/skills/writing/professional-communication .claude/skills/professional-communication
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 85% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
Claude Code (global)
bash mkdir -p ~/.claude/skills cp -r ~/.ai-skills/skills/writing/professional-communication ~/.claude/skills/professional-communication
External Model or Provider Selection
Medium
- Category
- Excessive Agency
- Confidence
- 90% confidence
- Finding
Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.
- Content
md --- name: professional-communication model: standard description: Write effective professional messages for software teams. Use when drafting emails, Slack/Teams messages, meeting agendas, status updates, or translating technical concepts for non-technical audiences. Triggers on email, slack, teams, message, meeting agenda, status update, stakeholder communication, escalation, jargon translation. ---
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The trigger description is extremely broad, covering generic terms like email, message, status update, and stakeholder communication. Overbroad triggers can cause the skill to activate in many routine contexts, increasing unintended data exposure to the skill and creating opportunities for prompt-scope expansion or misuse in situations where the user did not intend this skill to run.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 96% confidence
- Finding
The installation command uses
npx clawhub@latest, which fetches and executes the latest published package version at install time rather than a pinned, reviewed version. This creates a supply-chain risk: if the upstream package is compromised or a breaking/malicious release is published, users of the skill may execute unintended code during installation.- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
The templates encourage inclusion of links, error messages, blockers, and customer or business impact details, but they do not remind users to sanitize sensitive data before sending. In a professional communication skill, that omission can lead to accidental disclosure of internal URLs, credentials in pasted errors, customer information, or confidential incident details to the wrong audience.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The guidance recommends recording meetings but does not mention obtaining consent, complying with workplace policy, or considering legal/privacy requirements. In a professional communication skill, this omission can normalize privacy-sensitive behavior and lead users to record participants without appropriate notice or authorization.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The section instructs users to record important meetings and share summaries, but omits disclosure, consent, retention, and sensitivity considerations. That can cause unintentional privacy violations, especially in cross-jurisdiction or externally attended meetings, because users may treat recording as a default best practice rather than a controlled action.
- Content
Static analysis
No suspicious patterns detected.