Realtime React Hooks

• Outcome: Review
• Latest audit: Sep 10, 2026 · 4:38 PM UTC
• Version: 1.0.0

Overview

The skill content is ordinary React real-time hook guidance, but its documented install paths rely on mutable, unpinned remote execution that users should review before installing.

Review or pin the installer before running the documented npx commands, especially in sensitive development environments. The hook examples themselves are conventional, but only connect them to trusted authenticated SSE/WebSocket endpoints and avoid placing sensitive payloads on channels you do not control.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:16

Finding

Unpinned Package Execution Through ClawHub Installation Command

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: README.md:26

Finding

Unpinned Package Execution Repeated in README Installation Instructions

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: README.md:20

Finding

Ambiguous and Mutable Third-Party Installation via npx add

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (9)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

The README instructs users to execute a remote package/tool via npx add without any version pinning or integrity control. This creates a supply-chain risk because future changes to the referenced package or resolver behavior could cause users to fetch and run unexpected code during installation.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

npx clawhub@latest install realtime-react-hooks uses the mutable latest tag, which can change over time and cause execution of unreviewed code. For an installation path that likely runs code on the user's machine, this is a meaningful supply-chain exposure even if the current package is benign.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 39)May include surrounding context.

From your project root:

bash

mkdir -p .cursor/skills
cp -r ~/.ai-skills/skills/realtime/realtime-react-hooks .cursor/skills/realtime-react-hooks

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 55)May include surrounding context.

From your project root:

bash

mkdir -p .claude/skills
cp -r ~/.ai-skills/skills/realtime/realtime-react-hooks .claude/skills/realtime-react-hooks

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 62)May include surrounding context.

Claude Code (global)

bash

mkdir -p ~/.claude/skills
cp -r ~/.ai-skills/skills/realtime/realtime-react-hooks ~/.claude/skills/realtime-react-hooks

External Model or Provider Selection

Medium

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: realtime-react-hooks
model: standard
description: React hooks for real-time data with SSE, WebSocket, and SWR integration. Covers connection management, reconnection logic, and optimistic updates. Use when building React apps with real-time features. Triggers on SSE hook, WebSocket hook, real-time React, useEventSource, live updates.
---

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The description says the skill triggers on phrases including "real-time React" and "live updates," which are broad enough to appear in normal discussion rather than a clear invocation. The file does not provide tighter trigger constraints or negative examples to distinguish when the skill should or should not activate.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 88% confidence

Finding

The installation command uses npx clawhub@latest, which pulls and executes the newest published package version at install time. This creates a supply-chain risk because a compromised or malicious upstream release could be executed immediately by users without version review or integrity pinning.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

This markdown file instructs users to create EventSource and WebSocket connections that exchange application data, but it does not include any warning about network behavior, backend trust, authentication, or privacy-sensitive payloads. For markdown files, safety-relevant behaviors that may affect user data or privacy should be disclosed.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.