ClawHub
Back to skill

Security audit

React Composition

Security checks for vulnerabilities and agentic risk

Overview

This is a React guidance skill, but its install instructions ask users to run mutable remote npm and GitHub code, so it should be reviewed before installation.

Install only from a reviewed, pinned version or immutable commit, and avoid the `npx add` and `@latest` commands in sensitive environments. Prefer project-scoped installation over global installation unless you want the skill available across sessions.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:37
Finding

Execution of an Unpinned Third-Party Package Through npx

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 37; README.md, line 31
Vulnerability Type: Unpinned executable dependency
Risk Level: Medium

Vulnerable Code

SKILL.md, line 37:

bash
npx clawhub@latest install react-composition

README.md, line 31:

bash
npx clawhub@latest install react-composition

Technical Analysis

The installation instructions use npx to download and execute the mutable latest release of the third-party clawhub package. This is not merely a dependency download: npx runs package-supplied executable code under the privileges of the user invoking the command.

The project does not provide an exact package version, integrity hash, lockfile, vendored installer, or verification procedure. Consequently, the code executed by this documented command can change after the skill has been reviewed. A compromised package publisher account, npm registry release, transitive dependency, or package distribution channel could turn the installation command into an arbitrary-code execution path.

Attack Path

  1. An attacker compromises the clawhub package publisher, its release process, or a dependency used by a future release.
  2. The attacker publishes a malicious release and assigns or causes it to receive the latest distribution tag.
  3. A user follows the installation instructions and executes npx clawhub@latest install react-composition.
  4. npx retrieves the current mutable release and executes its CLI and any applicable package lifecycle behavior.
  5. The malicious package executes with the permissions and environmental access of the invoking user.

Impact Assessment

Successful exploitation could execute arbitrary commands with the invoking user's privileges. Depending on the environment, this could allow access to project source code, writable user files, environment variables, developer credentials, SSH configuration, package registry tokens, or other resources available to that us ...[truncated 279 chars]

Remediation
View remediation

Remediation Suggestions

  1. Replace @latest with an exact, reviewed version, for example clawhub@X.Y.Z.
  2. Publish and document the expected npm registry, package identity, version, and integrity checksum.
  3. Verify the package provenance and signature before execution where supported.
  4. Use a lockfile or reviewed local installer so installation does not resolve mutable code at runtime.
  5. Avoid running the installer with administrative privileges.
  6. In CI environments, execute installation in a sandbox with minimal filesystem access, restricted credentials, and limited network permissions.
  7. Establish a process for reviewing each package version before updating the documented pin.

T08 · Insecure Dependencies

Error
Location
README.md:25
Finding

Ambiguous Unversioned npx Command Executes Remote Package Code

Content
View full analysis

Vulnerability Details

File Location: README.md, line 25
Vulnerability Type: Unsafe and unpinned package execution
Risk Level: High

Vulnerable Code

bash
npx add https://github.com/wpank/ai/tree/main/skills/frontend/react-composition

Technical Analysis

The command invokes npx add, which causes npm tooling to resolve and execute an npm package or binary named add; it is not a built-in synonym for a standard, non-executing npm copy operation. The package is not pinned to an exact version and no integrity value or publisher verification is supplied.

The command also points to content under a mutable GitHub main branch rather than an immutable commit. This creates two independently mutable trust boundaries: the executable package resolved as add and the remote repository content supplied to it. Neither component is included in the audited artifact, so the effective behavior can change after review.

Attack Path

  1. An attacker compromises, replaces, or publishes a malicious version of the npm package resolved by npx add, or compromises the referenced GitHub repository or branch.
  2. The attacker modifies the resolved executable or remote branch content to include malicious behavior.
  3. A user copies the documented command from README.md.
  4. npx downloads and executes the unversioned add package.
  5. The executable processes content from the mutable GitHub branch and runs attacker-controlled behavior with the user's permissions.

Impact Assessment

A malicious resolved package can execute arbitrary code as the invoking user before or while processing the supplied URL. Potential consequences include theft of source code and credentials, modification of the local project, installation of additional tooling, corruption of user files, or use of the development environment as a pivot point.

The mutable GitHub branch additionally permits reviewed content to be replaced without changing the documented command. The no ...[truncated 172 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove the ambiguous npx add instruction.
  2. Replace it with a recognized installation mechanism whose behavior is clearly documented and independently reviewable.
  3. Pin every executable npm package to an exact audited version and verify its integrity and publisher provenance.
  4. Replace the mutable main branch URL with an immutable commit identifier or signed release artifact.
  5. Publish a cryptographic checksum for the expected downloaded content and require verification before installation.
  6. Prefer a non-executing download or copy procedure when installing documentation-only skill content.
  7. If remote execution is unavoidable, run it in a restricted sandbox without sensitive credentials, administrative privileges, or unrestricted filesystem access.

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (7)

Rp1

Medium
Category
MCP Rug Pull
Confidence
91% confidence
Finding

The README instructs users to run npx add against a remote GitHub URL without any pinned version, commit, or integrity control. This creates a supply-chain risk because the referenced content can change over time, causing future installs to fetch different code than originally reviewed.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
93% confidence
Finding

The command npx clawhub@latest install react-composition uses the floating latest tag, which can resolve to different code at different times. If the package or its dependencies are compromised, users may execute attacker-controlled code during installation.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
78% confidence
Finding

The README encourages copying the skill into persistent per-project and global agent skill directories, which causes the behavior to remain available across sessions. Persistence increases blast radius if the skill content is later found unsafe, because it may continue to be loaded automatically until manually removed.

Content

Scanner excerpt · README.md (reported line 41)May include surrounding context.

From your project root:

bash
mkdir -p .cursor/skills
cp -r ~/.ai-skills/skills/frontend/react-composition .cursor/skills/react-composition

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
85% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 57)May include surrounding context.

From your project root:

bash
mkdir -p .claude/skills
cp -r ~/.ai-skills/skills/frontend/react-composition .claude/skills/react-composition

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
85% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 64)May include surrounding context.

Claude Code (global)

bash
mkdir -p ~/.claude/skills
cp -r ~/.ai-skills/skills/frontend/react-composition ~/.claude/skills/react-composition

External Model or Provider Selection

Medium
Category
Excessive Agency
Confidence
90% confidence
Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md
---
name: react-composition
model: standard
description:
  React composition patterns for scalable component architecture. Use when
  refactoring components with boolean prop proliferation, building flexible

Rp1

Medium
Category
MCP Rug Pull
Confidence
92% confidence
Finding

The installation command uses npx clawhub@latest install react-composition, which pulls and executes the latest published package version at runtime rather than a pinned, reviewed release. That creates a supply-chain risk: if the package is compromised or a breaking/malicious update is published, users may execute attacker-controlled code during installation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.