React Modernization

• Outcome: Review
• Latest audit: Sep 10, 2026 · 4:36 PM UTC
• Version: 1.0.0

Overview

The skill is coherent React migration guidance, but it repeatedly recommends running unpinned remote tools that can change after review and rewrite a project.

Review this skill before installing if your projects contain sensitive source code or credentials. Prefer pinning installer and codemod versions or immutable commits, run migrations in a clean branch or sandbox, and inspect the full generated diff before committing changes.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (4)

T08 · Insecure Dependencies

Warning

• Location: README.md:26
• Finding: Installation from a Mutable GitHub Branch## Vulnerability Details **File Location**: `README.md:26-29` **Vulnerability Type**: Execution of an unpinned remote dependency **Risk Level**: Medium **Vulnerable Code**: ```bash ## Installation ```bash npx add https://github.com/wpank/ai/tree/main/skills/frontend/react-modernization ``` ``` ### Technical Analysis The documented installation command retrieves content from the mutable `main` branch of a remote GitHub repository. It does not identify an immutable commit SHA, signed release, or verified integrity hash. Consequently, the code installed when a user runs this command can differ from the code that was originally audited. Because the operation is initiated through `npx`, the installation process may execute package lifecycle or installer code with the permissions of the invoking user. This creates a supply-chain boundary in which compromise of the upstream repository, maintainer account, or referenced content could result in unreviewed code being installed or executed. ### Attack Path 1. An attacker compromises the upstream repository or a maintainer account. 2. The attacker modifies content reachable through the `main` branch. 3. A user follows the installation command in `README.md`. 4. `npx` retrieves the currently available remote content rather than an immutable reviewed revision. 5. Any supported installer or lifecycle code executes with the invoking user's privileges. ### Impact Assessment A compromised remote source could execute arbitrary code under the invoking user's account. Depending on that user's permissions, this could permit modification of project files, access to readable environment data and credentials, installation of additional dependencies, or further network activity. The command itself does not request elevated privileges, so the direct scope is limited to the user's existing permissions.
• Remediation: ## Remediation Suggestions - Replace the mutable `main` reference with an immutable, reviewed commit SHA or signed release tag. - Publish and verify a cryptographic integrity hash for downloaded content. - Prefer a package manager workflow backed by a committed lockfile and integrity metadata. - Review installer and lifecycle scripts before execution. - Run installation in a restricted development environment without production credentials.

T08 · Insecure Dependencies

Warning

• Location: README.md:32
• Finding: Execution of the Unpinned Latest ClawHub Installer in README## Vulnerability Details **File Location**: `README.md:32-35` **Vulnerability Type**: Unpinned third-party package execution **Risk Level**: Medium **Vulnerable Code**: ```bash ### OpenClaw / Moltbot / Clawbot ```bash npx clawhub@latest install react-modernization ``` ``` ### Technical Analysis The command explicitly asks `npx` to download and execute the package version associated with the mutable `latest` tag. The package version and effective installer code can therefore change after this Skill has been reviewed. No exact version, lockfile integrity value, signature, or checksum is specified. `npx` executes downloaded package code locally. If the package publisher, registry account, release pipeline, or dependency chain is compromised, a malicious release assigned to `latest` could run before the user has an opportunity to review its implementation. ### Attack Path 1. An attacker compromises the `clawhub` package, publisher account, release process, or dependency chain. 2. A malicious version is published and assigned the `latest` distribution tag. 3. A user runs the documented command. 4. `npx` downloads and executes the malicious package version. 5. The package operates with the invoking user's permissions and can install altered Skill content or perform other local actions. ### Impact Assessment Successful exploitation could provide arbitrary code execution with the invoking user's privileges. The attacker could modify repositories, read files and environment variables accessible to that user, tamper with installed Skills, or initiate network connections. No privilege escalation is inherent in the documented command; access remains bounded by the user's current operating-system permissions.
• Remediation: ## Remediation Suggestions - Pin `clawhub` to an exact audited version instead of `@latest`. - Record package integrity information in a lockfile. - Verify package provenance and signatures where supported. - Install the package as a reviewed development dependency before invoking it. - Execute installation in a sandbox or least-privileged environment and inspect the resulting files.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:35
• Finding: Execution of the Unpinned Latest ClawHub Installer in Skill Instructions## Vulnerability Details **File Location**: `SKILL.md:35-38` **Vulnerability Type**: Unpinned third-party package execution **Risk Level**: Medium **Vulnerable Code**: ```bash ### OpenClaw / Moltbot / Clawbot ```bash npx clawhub@latest install react-modernization ``` ``` ### Technical Analysis The Skill instructions direct users or agents to execute the mutable `latest` release of `clawhub`. The effective code is not fixed to the version that was reviewed, and no integrity or provenance verification is required. Since `npx` can download and immediately execute the selected package, compromise of the package distribution channel could turn this otherwise legitimate installation instruction into a local code-execution path. ### Attack Path 1. An attacker gains control of the relevant package publication channel or compromises its dependency chain. 2. The attacker publishes malicious code under the version selected by `latest`. 3. A user or agent follows the command in `SKILL.md`. 4. `npx` retrieves and executes the altered package. 5. The malicious installer acts within the invoking account's accessible environment. ### Impact Assessment Exploitation could cause arbitrary commands to run with the invoking user's privileges, potentially exposing readable project data, environment variables, local credentials, or writable files. It could also install modified Skill instructions that affect later use. The repository contains no evidence that the current upstream package is malicious; the risk arises from executing a mutable, unverified dependency.
• Remediation: ## Remediation Suggestions - Replace `clawhub@latest` with an exact, audited version. - Require package integrity and provenance verification. - Document the expected package digest and publisher identity. - Avoid automatic execution of packages that have not already been installed and reviewed. - Use a restricted environment and inspect installed Skill content before enabling it.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:295
• Finding: Unpinned Codemod Package Executes with Source-Tree Write Access## Vulnerability Details **File Location**: `SKILL.md:295-306` **Vulnerability Type**: Unpinned development-tool dependency execution **Risk Level**: Medium **Vulnerable Code**: ```bash ### Run Official React Codemods ```bash # Update to new JSX transform (no React import needed) npx codemod@latest react/19/replace-reactdom-render # Update deprecated APIs npx codemod@latest react/19/replace-string-ref # Class to function components npx codemod@latest react/19/replace-use-form-state ``` ``` ### Technical Analysis All three commands download and execute the mutable `latest` version of the `codemod` package. No exact package version, lockfile integrity value, checksum, or signature is provided. Codemod tools are particularly sensitive because their legitimate function requires reading and rewriting source files. A compromised package would therefore execute in a context where broad repository access appears expected. A malicious package version could perform actions unrelated to the requested React transformations, including modifying configuration or scripts, collecting accessible data, or adding code that is later committed and deployed. ### Attack Path 1. An attacker compromises the `codemod` publisher, registry release process, or dependency chain. 2. The attacker publishes a malicious release and causes it to resolve through `@latest`. 3. A developer runs one of the documented migration commands from a project directory. 4. `npx` downloads and executes the compromised package. 5. The package reads or modifies the source tree and may execute additional commands or initiate network activity. 6. Malicious changes may be committed or deployed if generated output is not carefully reviewed. ### Impact Assessment The immediate impact is arbitrary code execution with the developer's privileges and read/write access to the target repository. Potential consequences include source-code tampering, theft of ...[truncated 275 chars]
• Remediation: ## Remediation Suggestions - Pin the codemod package to an exact version that has been reviewed. - Install it as a development dependency using a committed lockfile with integrity metadata. - Verify package provenance or signatures before use. - Run codemods in a clean, isolated branch or disposable sandbox without sensitive credentials. - Back up the repository and require manual review of the complete generated diff. - Restrict network access during transformation where practical. - Run tests and security scans before committing or deploying transformed code.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence
• Finding: The README instructs users to execute a remote package/installer via `npx add` without pinning to a specific version or immutable commit. This creates a supply-chain risk because future changes to the referenced package or installer behavior could cause users to fetch and run unexpected code.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence
• Finding: Using `npx clawhub@latest install react-modernization` relies on the moving `latest` tag, which can change over time and cause execution of unreviewed code. Because `npx` may download and run packages immediately, this increases exposure to package compromise or malicious updates.

Session Persistence

Medium

• Category: Rogue Agent

Content

From your project root:

```bash
mkdir -p .cursor/skills
cp -r ~/.ai-skills/skills/frontend/react-modernization .cursor/skills/react-modernization
```

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

From your project root:

```bash
mkdir -p .claude/skills
cp -r ~/.ai-skills/skills/frontend/react-modernization .claude/skills/react-modernization
```

• Confidence: 85% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

#### Claude Code (global)

```bash
mkdir -p ~/.claude/skills
cp -r ~/.ai-skills/skills/frontend/react-modernization ~/.claude/skills/react-modernization
```

• Confidence: 85% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

External Model or Provider Selection

Medium

• Category: Excessive Agency

Content

---
name: react-modernization
model: reasoning
---

# React Modernization

• Confidence: 90% confidence
• Finding: Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence
• Finding: The installation command uses `npx clawhub@latest`, which resolves and executes code from the registry at runtime without a fixed version. This creates a supply-chain risk: a compromised package, malicious update, or unexpected breaking change could run arbitrary code on the user's machine when following the skill instructions.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 88% confidence
• Finding: The skill instructs users to run `npx codemod@latest`, which downloads and executes the newest published package version on demand. If the package or one of its dependencies is compromised, this could lead to arbitrary code execution during migration workflows.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 88% confidence
• Finding: This is another instance of `npx codemod@latest`, carrying the same risk of executing unpinned remote code from the package registry. Because codemods often run over source trees with developer privileges, exploitation could affect both the local system and repository contents.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 88% confidence
• Finding: The final codemod command also uses `npx codemod@latest`, exposing users to the same supply-chain and arbitrary-code-execution risk. Repetition increases the likelihood that a user will run at least one unsafe command directly from the documentation.

Static analysis

No suspicious patterns detected.