ClawHub
Back to skill

Security audit

Project Documentation

Security checks for vulnerabilities and agentic risk

Overview

This is a documentation-template skill with no bundled executable code; the main caution is that its install instructions use mutable npx/GitHub sources.

Before installing, prefer a pinned ClawHub/package version or inspect the remote package instead of running mutable npx commands blindly. Use per-project installation when you do not want the skill available globally across future agent sessions.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:17
Finding

Installation Commands Execute Unpinned Third-Party Packages

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:17, README.md:26, and README.md:32
Vulnerability Type: Unpinned and unverified third-party dependency execution
Risk Level: Medium

Vulnerable Code

SKILL.md:16-18:

bash
npx clawhub@latest install project-documentation

README.md:25-27:

bash
npx add https://github.com/wpank/ai/tree/main/skills/meta/project-documentation

README.md:31-33:

bash
npx clawhub@latest install project-documentation

Technical Analysis

The documented installation procedures use npx, which can download and execute npm package code on the local system. The command npx clawhub@latest explicitly selects a mutable package release rather than a reviewed, exact version. Consequently, the code executed during installation can differ from the code that existed when this skill was audited.

The npx add command also executes an unpinned npm package named add and supplies a GitHub tree URL that is not tied to an immutable commit. Neither command specifies an expected integrity hash, verified package artifact, lockfile, or validation procedure.

This is a supply-chain weakness rather than evidence that the current upstream packages are malicious. Exploitation depends on an upstream package, publisher account, registry distribution path, or referenced repository being compromised or unexpectedly modified.

Attack Path

  1. An attacker compromises the publisher account, release process, registry package, or mutable repository reference used by the installation command.
  2. The attacker publishes a modified release under the package name or changes content reached through the mutable source reference.
  3. A user follows the installation instructions and runs one of the documented npx commands.
  4. npx downloads the current, unreviewed package implementation.
  5. The package CLI or associated lifecycle code executes with the privileges an ...[truncated 1081 chars]
Remediation
View remediation

Remediation Suggestions

  1. Replace clawhub@latest with an explicitly reviewed package version.
  2. Generate and publish an integrity hash for the expected package artifact, and verify it before execution.
  3. Replace the mutable GitHub tree reference with an immutable, reviewed commit identifier or signed release artifact.
  4. Avoid using an ambiguous npx add package invocation. Document an explicit installation mechanism whose package name, publisher, source, and purpose can be independently verified.
  5. Recommend inspecting downloaded package contents before execution, for example by retrieving a pinned artifact without immediately invoking its CLI.
  6. Document the expected publisher identity and canonical repository so users can detect dependency confusion, typosquatting, or publisher changes.
  7. Execute installation in a minimally privileged environment without unnecessary credentials, secrets, or access to sensitive repositories.
  8. Keep the pinned version and integrity metadata synchronized in both SKILL.md and README.md.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
Findings (8)

Rp1

Medium
Category
MCP Rug Pull
Confidence
88% confidence
Finding

The README instructs users to run npx add against a GitHub URL without pinning to an immutable version or commit. This creates a supply-chain risk because the referenced remote content can change over time, causing users to install code different from what was originally reviewed.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
86% confidence
Finding

Using npx clawhub@latest install project-documentation pulls and executes the latest published package version at runtime. If the package is compromised or a breaking/malicious version is published, users may execute unreviewed code during installation.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 42)May include surrounding context.

From your project root:

bash
mkdir -p .cursor/skills
cp -r ~/.ai-skills/skills/meta/project-documentation .cursor/skills/project-documentation

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
85% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 58)May include surrounding context.

From your project root:

bash
mkdir -p .claude/skills
cp -r ~/.ai-skills/skills/meta/project-documentation .claude/skills/project-documentation

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
85% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 65)May include surrounding context.

Claude Code (global)

bash
mkdir -p ~/.claude/skills
cp -r ~/.ai-skills/skills/meta/project-documentation ~/.claude/skills/project-documentation

External Model or Provider Selection

Medium
Category
Excessive Agency
Confidence
90% confidence
Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md
---
name: project-documentation
model: standard
description: Complete workflow for project documentation including ADRs, PRDs, personas, and docs organization. Use when setting up documentation for a new project or improving existing docs. Triggers on project documentation, ADR, PRD, personas, docs structure, documentation setup.
---

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The manifest description says the skill is used for 'improving existing docs' and 'triggers on project documentation, ADR, PRD, personas, docs structure, documentation setup' without defining exact activation phrases, exclusions, or boundaries. Terms like 'project documentation' and 'docs structure' are broad enough to overlap with ordinary conversation about documentation, increasing the risk of unintended invocation.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
92% confidence
Finding

The installation instruction uses npx clawhub@latest install project-documentation, which pulls and executes the latest remote package version at install time. This creates a supply-chain risk because users may unknowingly run newly published or compromised code without review, and skill context does not mitigate that risk.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.