ClawHub
Back to skill

Security audit

React Performance

Security checks for vulnerabilities and agentic risk

Overview

This is a React performance guidance skill with no hidden code execution, but its install instructions use mutable unpinned commands that users should treat carefully.

Review and preferably pin the installation commands before running them. The skill itself is a normal React/Next.js performance reference, but commands using `npx`, `@latest`, or a GitHub `main` branch can execute code that may change after this review.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T08 · Insecure Dependencies

Error
Location
README.md:32
Finding

Mutable ClawHub Package Is Downloaded and Executed During Installation

Content
View full analysis

Vulnerability Details

File Location: README.md:32 and SKILL.md:42
Vulnerability Type: Unpinned third-party package execution
Risk Level: High

Vulnerable Code

README.md:32:

bash
npx clawhub@latest install react-performance

SKILL.md:42:

bash
npx clawhub@latest install react-performance

Technical Analysis

The installation instructions use npx to download and execute the clawhub package. The @latest tag is mutable and does not identify a specific, audited package version or integrity hash. Consequently, the code executed by this command can change after the skill itself has been reviewed.

When the package is not already available locally, npx resolves it through the configured npm registry, downloads it, and runs its executable. Security therefore depends on the current registry package, its maintainers, the registry resolution configuration, and the package's transitive dependency chain. A compromised maintainer account, malicious future release, dependency compromise, or registry substitution could turn the documented installation command into an arbitrary-code execution channel.

Attack Path

  1. An attacker compromises the clawhub package, one of its dependencies, its publishing account, or the registry resolution path.
  2. The attacker publishes or causes resolution of a malicious version under the mutable latest tag.
  3. A user follows the installation instructions and runs npx clawhub@latest install react-performance.
  4. npx downloads the currently resolved package rather than a previously audited immutable artifact.
  5. Malicious package installation logic or CLI code executes with the privileges of the user running the command.
  6. The malicious code can access resources available to that user and may alter the local environment.

Impact Assessment

Successful exploitation permits arbitrary command execution under the installing user's acc ...[truncated 440 chars]

Remediation
View remediation

Remediation Suggestions

  • Replace @latest with an exact, reviewed package version, for example clawhub@X.Y.Z.
  • Verify the selected release against its published integrity hash, provenance, signature, and source repository before recommending execution.
  • Document the expected package registry and use a trusted registry configuration to reduce dependency-confusion and registry-substitution risks.
  • Commit an appropriate lockfile where installation occurs through a package manager, and require integrity verification for direct and transitive dependencies.
  • Avoid executing remotely resolved packages directly when possible. Install a reviewed version first and invoke its local binary.
  • Consider disabling lifecycle scripts with --ignore-scripts when compatible with the package, while recognizing that the CLI itself still executes code.
  • Use a restricted account or isolated environment for installation and do not expose production credentials or unrelated secrets to the process.
  • Keep the command consistent in both README.md and SKILL.md so an unsafe copy does not remain after remediation.

T08 · Insecure Dependencies

Error
Location
README.md:26
Finding

Ambiguous npx Command Executes an Unpinned Package Against a Mutable GitHub Reference

Content
View full analysis

Vulnerability Details

File Location: README.md:26
Vulnerability Type: Unsafe and ambiguous remote installation command
Risk Level: High

Vulnerable Code

bash
npx add https://github.com/wpank/ai/tree/main/skills/frontend/react-performance

Technical Analysis

This command invokes npx add, which can resolve and execute the third-party npm package or executable named add; it is not equivalent to a conventional, package-manager-specific installation command such as npm install. No exact version or integrity value is supplied for the executable.

The argument also points to a GitHub web interface path under the mutable main branch. It does not identify an immutable commit and is not a conventional Git repository reference or verified release artifact. The effective behavior therefore depends on remotely resolved code that is not contained in the audited project, and both the command implementation and referenced branch content can change after review.

An attacker who controls the resolved add package, its dependency chain, the associated publishing path, or relevant upstream content could cause users following these instructions to execute attacker-controlled code.

Attack Path

  1. An attacker compromises or replaces the npm package resolved for the add executable, one of its dependencies, or its publishing account.
  2. Alternatively, an attacker gains control over content referenced through the mutable upstream branch or manipulates dependency/registry resolution.
  3. A user copies and runs the documented npx add ... command.
  4. npx downloads and executes the unpinned add package.
  5. The package processes the mutable GitHub URL and runs attacker-controlled package or CLI logic.
  6. The attacker's code executes with the current user's privileges.

Impact Assessment

Exploitation could provide arbitrary code execution within the installing user's security context. Exposed ...[truncated 376 chars]

Remediation
View remediation

Remediation Suggestions

  • Remove the ambiguous npx add instruction.
  • Replace it with a documented command from a recognized package manager or with explicit manual installation steps that do not execute an unrelated package named add.
  • Reference an immutable Git commit, signed release tag, or release archive with a published cryptographic checksum instead of the mutable main branch.
  • If a helper CLI is required, pin it to an exact reviewed version and verify its package integrity and provenance.
  • Validate downloaded contents before installation and avoid automatically executing code from the retrieved repository.
  • Perform installation in a least-privileged, isolated environment without unrelated credentials.
  • Document the expected files and checksum so users can verify that retrieved content matches the reviewed skill package.

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (7)

Rp1

Medium
Category
MCP Rug Pull
Confidence
93% confidence
Finding

The README instructs users to run npx add against a GitHub URL without pinning to a specific immutable version or commit. That creates a supply-chain risk because future changes to the remote package or installer could cause different code to be fetched and executed than what was originally reviewed.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

npx clawhub@latest install react-performance uses the latest tag, which is mutable and can resolve to different code over time. Because npx downloads and executes packages, this exposes users to supply-chain compromise if the package is updated maliciously or the publisher account is compromised.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 42)May include surrounding context.

From your project root:

bash
mkdir -p .cursor/skills
cp -r ~/.ai-skills/skills/frontend/react-performance .cursor/skills/react-performance

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
85% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 58)May include surrounding context.

From your project root:

bash
mkdir -p .claude/skills
cp -r ~/.ai-skills/skills/frontend/react-performance .claude/skills/react-performance

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
85% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 65)May include surrounding context.

Claude Code (global)

bash
mkdir -p ~/.claude/skills
cp -r ~/.ai-skills/skills/frontend/react-performance ~/.claude/skills/react-performance

External Model or Provider Selection

Medium
Category
Excessive Agency
Confidence
90% confidence
Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md
---
name: react-performance
model: standard
description:
  React and Next.js performance optimization patterns. Use when writing,
  reviewing, or refactoring React/Next.js code to ensure optimal performance.

Rp1

Medium
Category
MCP Rug Pull
Confidence
93% confidence
Finding

The installation command uses npx clawhub@latest install react-performance, which fetches and executes the latest published package version at runtime. This creates a supply-chain risk because a compromised or newly introduced malicious version could be executed automatically by users installing the skill.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.