Realtime Dashboard

• Outcome: Review
• Latest audit: Sep 10, 2026 · 4:37 PM UTC
• Version: 1.0.0

Overview

The skill is a coherent real-time dashboard guide, but its documented install commands rely on mutable remote package/source execution that users should review before running.

Review or replace the install commands before use: prefer a pinned ClawHub version or verified release, avoid running ambiguous npx add commands from a mutable branch, and install globally only if you want this skill available across future agent sessions.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:14

Finding

Mutable npm Package Execution Through an Unpinned @latest Version

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:14-18; the same command is also present at README.md:25-29
Vulnerability Type: Supply-chain risk caused by execution of an unpinned third-party npm package
Risk Level: Medium

Complete Code Snippet:

markdown

### OpenClaw / Moltbot / Clawbot

```bash
npx clawhub@latest install realtime-dashboard

text

### Technical Analysis

The installation command uses `npx` to retrieve and execute the mutable `latest` release of the third-party `clawhub` npm package. The project does not pin a reviewed package version, provide a lockfile for this command, verify a package integrity hash, or require signature verification.

The effective code executed by this instruction can therefore change after this Skill has been reviewed. If the npm package, maintainer account, release process, or a transitive dependency is compromised, following the documented command could execute attacker-controlled package or lifecycle code.

This finding concerns the installation instruction rather than embedded project code. The audited project contains only Markdown files and does not itself include a malicious script.

### Attack Path

1. An attacker compromises the `clawhub` npm package, its publishing credentials, or a dependency incorporated into a new release.
2. The compromised release becomes the version resolved by the mutable `@latest` tag.
3. A user follows the installation instruction and runs `npx clawhub@latest install realtime-dashboard`.
4. `npx` downloads and executes the newly resolved package rather than a previously reviewed, immutable version.
5. Malicious package or lifecycle code runs with the permissions and environment of the user who launched the command.

### Impact Assessment

Successful exploitation could provide arbitrary code execution under the installing user's account. The accessible scope could include files writable by that user, the current proje
...[truncated 243 chars]

Remediation

View remediation

Remediation Suggestions

• Replace @latest with an explicitly reviewed package version.
• Prefer a lockfile-backed installation workflow where applicable.
• Verify npm provenance, signatures, and published integrity metadata before execution.
• Document the expected package publisher and checksum so users can verify the artifact.
• Review lifecycle scripts and transitive dependencies for the pinned release.
• Apply the same correction to the duplicate command in README.md:25-29.
• Consider instructing users to download and inspect the package before executing it in a restricted environment.

T08 · Insecure Dependencies

Warning

• Location: README.md:19

Finding

Unpinned Personal GitHub Source Passed to an Ambiguous npx Command

Content

View full analysis

Vulnerability Details

File Location: README.md:19-23
Vulnerability Type: Unsafe and unpinned external dependency installation
Risk Level: Medium

Complete Code Snippet:

markdown

## Installation

```bash
npx add https://github.com/wpank/ai/tree/main/skills/meta/realtime-dashboard

text

### Technical Analysis

This instruction invokes `npx add`, which causes npm tooling to resolve and run a package named `add`, rather than using the standard `npm install` command. The audited project does not identify or pin the expected `add` package version. This creates package-name confusion and permits the executable package resolved by `npx` to change after review.

The argument also references the mutable `main` branch of a personal GitHub repository instead of an immutable commit. No commit hash, release version, checksum, or signature is supplied. Consequently, both the command runner and the referenced source can change independently of this audited project.

### Attack Path

1. An attacker compromises the npm package resolved as `add`, its publisher, or the referenced GitHub account or repository.
2. The attacker publishes malicious executable package content or modifies content reachable through the mutable `main` branch.
3. A user copies and executes the documented `npx add` command.
4. `npx` retrieves and runs the resolved third-party command with the supplied remote repository URL.
5. Attacker-controlled package behavior executes with the invoking user's permissions or installs attacker-controlled content into an agent environment.

### Impact Assessment

Compromise of the executable npm package could result in arbitrary code execution under the user's account, with access to user-writable files, the current working directory, and process-visible secrets. Compromise only of the referenced repository could result in installation of altered Skill instructions or other unreviewed content, affecting s
...[truncated 165 chars]

Remediation

View remediation

Remediation Suggestions

• Replace the ambiguous npx add command with a documented and verified installation mechanism.
• Pin the installation utility to a reviewed package name and exact version if such a utility is genuinely required.
• Reference an immutable Git commit hash or signed release instead of the mutable main branch.
• Publish and verify cryptographic checksums or signatures for downloaded content.
• Clearly identify the trusted repository owner and expected destination files.
• Recommend reviewing downloaded Skill content before enabling it in an agent environment.
• Run installation with least privilege and without unnecessary credentials in the process environment.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (8)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The README instructs users to execute a remote package retrieval command via npx add without any version pinning, commit hash, or integrity verification. That creates a supply-chain risk because future changes to the referenced package or repository could cause users to fetch unexpected or malicious content.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The command npx clawhub@latest install realtime-dashboard uses the moving @latest tag, which is not reproducible and can silently pull changed code over time. If the package is compromised or a bad release is published, users following the README could execute attacker-controlled code.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 39)May include surrounding context.

From your project root:

bash

mkdir -p .cursor/skills
cp -r ~/.ai-skills/skills/meta/realtime-dashboard .cursor/skills/realtime-dashboard

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 55)May include surrounding context.

From your project root:

bash

mkdir -p .claude/skills
cp -r ~/.ai-skills/skills/meta/realtime-dashboard .claude/skills/realtime-dashboard

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 62)May include surrounding context.

Claude Code (global)

bash

mkdir -p ~/.claude/skills
cp -r ~/.ai-skills/skills/meta/realtime-dashboard ~/.claude/skills/realtime-dashboard

External Model or Provider Selection

Medium

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: realtime-dashboard
model: reasoning
description: Complete guide to building real-time dashboards with streaming data, WebSocket/SSE, and live updates. Orchestrates dual-stream architecture, React hooks, and data visualization. Use when building trading dashboards, monitoring UIs, or live analytics. Triggers on realtime dashboard, live data, streaming dashboard, trading UI, monitoring.
---

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger list includes broad phrases such as live data and monitoring, which are common in many benign conversations and can cause the skill to activate unexpectedly. Over-broad activation increases the chance of inappropriate context injection, accidental execution of workflows, or surfacing guidance when the user did not intend to use this skill.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence

Finding

The installation command invokes a remote package via npx clawhub@latest, which allows unpinned code to be fetched and executed at install time. If the package is compromised or a breaking/malicious release is published, users of the skill could run attacker-controlled code on their workstation or CI environment.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.