Resiliant Connections

• Outcome: Review
• Latest audit: Sep 10, 2026 · 4:38 PM UTC
• Version: 1.0.0

Overview

The skill content is mostly benign resilience-pattern guidance, but its installation instructions use mutable remote npx commands that could execute different code than the reviewed artifact.

Review and pin the installation source before installing. Prefer a reviewed exact ClawHub version or immutable commit, avoid running `npx` installers with elevated privileges, and treat the code examples as patterns to adapt and test rather than production-ready drop-ins.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: README.md:21
• Finding: Mutable remote packages are executed through unpinned npx installation commands<![CDATA[ ## Vulnerability Details **File Location**: `README.md:21-30`; duplicated in `SKILL.md:15-18` **Vulnerability Type**: Supply-chain exposure through mutable remote dependencies **Risk Level**: Medium ### Vulnerable Code `README.md:21-30`: ```bash ## Installation ```bash npx add https://github.com/wpank/ai/tree/main/skills/realtime/resilient-connections ``` ### OpenClaw / Moltbot / Clawbot ```bash npx clawhub@latest install resilient-connections ``` ``` `SKILL.md:15-18`: ```bash ```bash npx clawhub@latest install resilient-connections ``` ``` ### Technical Analysis The documented installation process instructs users to execute packages retrieved from mutable remote sources. The command using `clawhub@latest` does not pin the installer to a reviewed version. A future release under that package name will therefore be downloaded and executed even if it differs from the version originally audited. Depending on npm configuration and package behavior, execution can include CLI entry points and package lifecycle code under the installing user's account. The GitHub source is similarly not pinned to a commit SHA. Its effective contents can change after review. In addition, `npx add ...` invokes an npm package or executable named `add`; it is not a native, self-contained npm command for securely installing the referenced directory. This introduces an additional dependency whose identity, version, and integrity are not documented. No evidence shows that the current remote packages are malicious. The vulnerability is the unsafe trust and execution model presented by the installation instructions. ### Attack Path 1. An attacker compromises the npm publisher account, the relevant package, or the upstream repository, or publishes a malicious version through an applicable package-resolution weakness. 2. The attacker adds malicious CLI or lifecycle behavior to the mutable package or remote source. 3. A user follows the documented `npx` installation command ...[truncated 825 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin every npm CLI dependency to a reviewed exact version rather than using `@latest`. 2. Publish and verify integrity information for the installer, such as a lockfile and npm integrity hash. 3. Pin GitHub-based sources to an immutable reviewed commit SHA instead of a mutable branch or directory URL. 4. Replace the ambiguous `npx add ...` command with an explicitly documented and trusted installation mechanism. 5. Use `npx --ignore-existing --package=<trusted-package>@<exact-version> <command>` or an equivalent explicit invocation where appropriate. 6. Document the package identity, expected publisher, version, checksums, and required permissions. 7. Recommend reviewing downloaded code and avoiding elevated execution before installation. ]]>

T09 · Insecure Skill Coding Practices

Note

• Location: SKILL.md:139
• Finding: Resilient fetch example reuses one timeout controller across all retry attempts<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:139-173` **Vulnerability Type**: Incorrect timeout lifecycle in retry implementation **Risk Level**: Low ### Vulnerable Code ```typescript interface FetchOptions extends RequestInit { timeout?: number; retries?: number; } async function resilientFetch( url: string, options: FetchOptions = {} ): Promise<Response> { const { timeout = 10000, retries = 3, ...fetchOptions } = options; const controller = new AbortController(); const timeoutId = setTimeout(() => controller.abort(), timeout); const fetchWithTimeout = async () => { try { const response = await fetch(url, { ...fetchOptions, signal: controller.signal, }); if (!response.ok && response.status >= 500) { throw new Error(`Server error: ${response.status}`); } return response; } finally { clearTimeout(timeoutId); } }; return withRetry(fetchWithTimeout, { maxRetries: retries, baseDelay: 1000, maxDelay: 10000, }); } ``` ### Technical Analysis The `AbortController` and timeout are created once, outside the function passed to `withRetry`. They are consequently shared by every retry attempt. If the first request completes or fails before the timeout, its `finally` block clears the only timeout. Subsequent retry attempts still use the same controller but no longer have an active timer, so they can remain pending indefinitely. If the timeout aborts the first attempt, the controller remains permanently aborted. Every retry then receives the same already-aborted signal and fails immediately instead of receiving an independent timeout window. This contradicts the intended resilient behavior and can undermine availability when the example is copied into a production client. It is principally a reliability and denial-of-service concern rather than a confidentiality or privilege-escalation issue. ### Attack Path 1. An application adopts the do ...[truncated 1252 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions Create a new `AbortController` and timeout inside each retry attempt so every request receives an independent timeout lifecycle: ```typescript const fetchWithTimeout = async () => { const controller = new AbortController(); const timeoutId = setTimeout(() => controller.abort(), timeout); try { const response = await fetch(url, { ...fetchOptions, signal: controller.signal, }); if (!response.ok && response.status >= 500) { throw new Error(`Server error: ${response.status}`); } return response; } finally { clearTimeout(timeoutId); } }; ``` Additionally: 1. Distinguish timeout, network, and HTTP errors before deciding whether to retry. 2. Restrict automatic retries to idempotent operations unless an idempotency mechanism is implemented. 3. Consider an overall operation deadline in addition to per-attempt timeouts. 4. Add tests covering a 5xx first response followed by a hanging retry, and an aborted first attempt followed by a successful retry. 5. Ensure externally supplied abort signals are composed safely if caller cancellation must also be supported. ]]>

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (8)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence
• Finding: The README instructs users to execute remote tooling via `npx add` against a GitHub URL without pinning to an immutable version, tag, or commit. This creates a supply-chain risk because future changes to the referenced package or repository could alter what gets installed or executed, and installation commands in setup docs are commonly copied verbatim by users.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence
• Finding: `npx clawhub@latest install resilient-connections` explicitly pulls the latest version of a remote package, which is mutable and can change over time. If the package is compromised or a breaking/malicious update is published, users following the README may execute unreviewed code during installation.

Session Persistence

Medium

• Category: Rogue Agent

Content

From your project root:

```bash
mkdir -p .cursor/skills
cp -r ~/.ai-skills/skills/realtime/resilient-connections .cursor/skills/resilient-connections
```

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

From your project root:

```bash
mkdir -p .claude/skills
cp -r ~/.ai-skills/skills/realtime/resilient-connections .claude/skills/resilient-connections
```

• Confidence: 85% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

#### Claude Code (global)

```bash
mkdir -p ~/.claude/skills
cp -r ~/.ai-skills/skills/realtime/resilient-connections ~/.claude/skills/resilient-connections
```

• Confidence: 85% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

External Model or Provider Selection

Medium

• Category: Excessive Agency

Content

---
name: resilient-connections
model: standard
description: Patterns for building resilient API clients and real-time connections with retry logic, circuit breakers, and graceful degradation. Use when building production systems that need to handle failures. Triggers on retry logic, circuit breaker, connection resilience, exponential backoff, API client, fault tolerance.
---

• Confidence: 90% confidence
• Finding: Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Unbounded Resource Access

Medium

• Category: Excessive Agency

Content

}

  close() {
    this.maxRetries = 0; // Prevent reconnection
    this.ws?.close();
  }
}

• Confidence: 80% confidence
• Finding: Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.

Static analysis

No suspicious patterns detected.