Resiliant Connections

• Outcome: Review
• Latest audit: Sep 10, 2026 · 4:38 PM UTC
• Version: 1.0.0

Overview

The skill content is mostly benign resilience-pattern guidance, but its installation instructions use mutable remote npx commands that could execute different code than the reviewed artifact.

Review and pin the installation source before installing. Prefer a reviewed exact ClawHub version or immutable commit, avoid running `npx` installers with elevated privileges, and treat the code examples as patterns to adapt and test rather than production-ready drop-ins.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: README.md:21

Finding

Mutable remote packages are executed through unpinned npx installation commands

Content

View full analysis

Remediation

View remediation

@ ` or an equivalent explicit invocation where appropriate. 6. Document the package identity, expected publisher, version, checksums, and required permissions. 7. Recommend reviewing downloaded code and avoiding elevated execution before installation. ]]>

T09 · Insecure Skill Coding Practices

Note

• Location: SKILL.md:139

Finding

Resilient fetch example reuses one timeout controller across all retry attempts

Content

View full analysis

{ const { timeout = 10000, retries = 3, ...fetchOptions } = options; const controller = new AbortController(); const timeoutId = setTimeout(() => controller.abort(), timeout); const fetchWithTimeout = async () => { try { const response = await fetch(url, { ...fetchOptions, signal: controller.signal, }); if (!response.ok && response.status >= 500) { throw new Error(`Server error: ${response.status}`); } return response; } finally { clearTimeout(timeoutId); } }; return withRetry(fetchWithTimeout, { maxRetries: retries, baseDelay: 1000, maxDelay: 10000, }); } ``` ### Technical Analysis The `AbortController` and timeout are created once, outside the function passed to `withRetry`. They are consequently shared by every retry attempt. If the first request completes or fails before the timeout, its `finally` block clears the only timeout. Subsequent retry attempts still use the same controller but no longer have an active timer, so they can remain pending indefinitely. If the timeout aborts the first attempt, the controller remains permanently aborted. Every retry then receives the same already-aborted signal and fails immediately instead of receiving an independent timeout window. This contradicts the intended resilient behavior and can undermine availability when the example is copied into a production client. It is principally a reliability and denial-of-service concern rather than a confidentiality or privilege-escalation issue. ### Attack Path 1. An application adopts the do ...[truncated 1252 chars]

Remediation

View remediation

{ const controller = new AbortController(); const timeoutId = setTimeout(() => controller.abort(), timeout); try { const response = await fetch(url, { ...fetchOptions, signal: controller.signal, }); if (!response.ok && response.status >= 500) { throw new Error(`Server error: ${response.status}`); } return response; } finally { clearTimeout(timeoutId); } }; ``` Additionally: 1. Distinguish timeout, network, and HTTP errors before deciding whether to retry. 2. Restrict automatic retries to idempotent operations unless an idempotency mechanism is implemented. 3. Consider an overall operation deadline in addition to per-attempt timeouts. 4. Add tests covering a 5xx first response followed by a hanging retry, and an aborted first attempt followed by a successful retry. 5. Ensure externally supplied abort signals are composed safely if caller cancellation must also be supported. ]]>

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (8)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The README instructs users to execute remote tooling via npx add against a GitHub URL without pinning to an immutable version, tag, or commit. This creates a supply-chain risk because future changes to the referenced package or repository could alter what gets installed or executed, and installation commands in setup docs are commonly copied verbatim by users.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

npx clawhub@latest install resilient-connections explicitly pulls the latest version of a remote package, which is mutable and can change over time. If the package is compromised or a breaking/malicious update is published, users following the README may execute unreviewed code during installation.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 39)May include surrounding context.

From your project root:

bash

mkdir -p .cursor/skills
cp -r ~/.ai-skills/skills/realtime/resilient-connections .cursor/skills/resilient-connections

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 55)May include surrounding context.

From your project root:

bash

mkdir -p .claude/skills
cp -r ~/.ai-skills/skills/realtime/resilient-connections .claude/skills/resilient-connections

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 62)May include surrounding context.

Claude Code (global)

bash

mkdir -p ~/.claude/skills
cp -r ~/.ai-skills/skills/realtime/resilient-connections ~/.claude/skills/resilient-connections

External Model or Provider Selection

Medium

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: resilient-connections
model: standard
description: Patterns for building resilient API clients and real-time connections with retry logic, circuit breakers, and graceful degradation. Use when building production systems that need to handle failures. Triggers on retry logic, circuit breaker, connection resilience, exponential backoff, API client, fault tolerance.
---

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Unbounded Resource Access

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.

Content

Scanner excerpt · SKILL.md (reported line 220)May include surrounding context.

md

}

  close() {
    this.maxRetries = 0; // Prevent reconnection
    this.ws?.close();
  }
}

Static analysis

No suspicious patterns detected.