Websocket Hub Patterns

• Outcome: Review
• Latest audit: Sep 10, 2026 · 4:39 PM UTC
• Version: 1.0.0

Overview

This looks like a legitimate WebSocket implementation guide, but its install instructions rely on mutable external commands that should be reviewed before use.

Review the skill content before installing, and prefer pinned, reviewed installer versions and immutable source references instead of running npx commands that resolve latest packages or GitHub main branches. The WebSocket/Redis patterns themselves are purpose-aligned, but adoption should include normal review of Redis data contents, channel naming, retention, and access controls.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:15
• Finding: Unpinned ClawHub Package Execution in Skill Installation Instructions<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 15-17 **Vulnerability Type**: Unpinned third-party package execution **Risk Level**: Medium ### Vulnerable Code ```bash npx clawhub@latest install websocket-hub-patterns ``` ### Technical Analysis The installation command instructs users to execute `clawhub@latest` through `npx`. The `latest` tag is mutable, so the package version and executable content may change after this Skill has been reviewed. `npx` downloads and executes the selected package with the privileges of the user performing the installation. The command does not pin an audited version, commit, integrity hash, or signature. Consequently, compromise of the npm package, publisher account, package distribution infrastructure, or a future malicious release could turn the documented installation process into an arbitrary code-execution channel. No evidence establishes that the current `clawhub` package is malicious; the vulnerability is the unsafe trust and version-pinning model used by the installation instruction. ### Attack Path 1. An attacker compromises the `clawhub` npm package, its publisher account, or the associated release process. 2. The attacker publishes a malicious release and assigns or causes it to receive the `latest` distribution tag. 3. A user follows the installation command from `SKILL.md`. 4. `npx` retrieves the mutable `latest` release and executes its package entry point. 5. The malicious package runs with the installing user's permissions and may access files, credentials, environment variables, or network resources available to that user. ### Impact Assessment Successful exploitation could provide arbitrary code execution with the privileges of the user running the installation. The affected scope may include the user's project files, home-directory data, development credentials, environment variables, SSH or API credentials readable by that account, and reachable internal or external services. ...[truncated 135 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Replace `clawhub@latest` with a specific, reviewed package version. - Where supported, verify the package using an expected integrity hash or trusted signature. - Review the pinned package's executable entry point and lifecycle scripts before recommending execution. - Use lockfiles or an equivalent immutable dependency manifest for reproducible installation. - Recommend running installation with least privilege and without unnecessary secrets in the environment. - Establish a controlled process for reviewing and deliberately updating the pinned version. Example hardened form: ```bash npx --yes clawhub@<reviewed-version> install websocket-hub-patterns ``` The placeholder must be replaced with an explicitly reviewed version; it should not resolve through a mutable tag. ]]>

T08 · Insecure Dependencies

Warning

• Location: README.md:24
• Finding: Mutable GitHub Source Installed Through an Unpinned npm Executable<![CDATA[ ## Vulnerability Details **File Location**: `README.md`, lines 24-26 **Vulnerability Type**: Unsafe and mutable third-party installation source **Risk Level**: Medium ### Vulnerable Code ```bash npx add https://github.com/wpank/ai/tree/main/skills/realtime/websocket-hub-patterns ``` ### Technical Analysis This command presents two supply-chain trust problems: 1. `npx add` invokes an npm package executable named `add` without pinning its package version. 2. The requested GitHub content is referenced through the mutable `main` branch rather than an immutable commit. The effective behavior and installed content can therefore change without any modification to this repository. A future release or compromise of the npm package named `add`, or unauthorized modification of the upstream GitHub branch, could cause users to retrieve or execute content that was never included in this audit. No malicious behavior by the current npm package or GitHub repository was established. The confirmed issue is the installation instruction's reliance on unpinned executable and source dependencies. ### Attack Path 1. An attacker compromises the npm package or publisher associated with the `add` executable, or compromises the upstream GitHub repository. 2. The attacker publishes malicious npm behavior or modifies content under the referenced `main` branch. 3. A user copies the command from the README. 4. `npx` resolves and executes the unpinned `add` package. 5. The installer retrieves content from the mutable upstream branch. 6. Malicious installer logic or substituted upstream content executes or is installed into the user's development environment. ### Impact Assessment Compromise of the executable installation path could result in arbitrary code execution under the installing user's account. Potentially exposed resources include local source code, writable project files, user-accessible credentials, environment variables, and network services. If only the upstre ...[truncated 242 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Do not invoke an ambiguous, unversioned npm executable such as `npx add`. - Pin the installer package to an explicitly reviewed version if that installer is required. - Replace the GitHub `main` reference with an immutable, reviewed commit hash or signed release tag. - Verify downloaded artifacts using a cryptographic checksum or trusted signature. - Prefer a transparent download-and-copy workflow that does not execute third-party lifecycle scripts. - Document the expected source commit and checksum so users can independently validate the retrieved content. - Periodically review updates before changing the pinned package version or Git commit. ]]>

T08 · Insecure Dependencies

Warning

• Location: README.md:30
• Finding: Unpinned ClawHub Package Execution in README Installation Instructions<![CDATA[ ## Vulnerability Details **File Location**: `README.md`, lines 30-32 **Vulnerability Type**: Unpinned third-party package execution **Risk Level**: Medium ### Vulnerable Code ```bash npx clawhub@latest install websocket-hub-patterns ``` ### Technical Analysis The README repeats an installation command that executes the mutable `latest` release of the `clawhub` npm package. Because the package version is not fixed, users cannot reliably reproduce the version that was originally reviewed. Executing the dependency through `npx` grants its code the permissions of the invoking user. A compromised publisher account, malicious future release, or package-distribution compromise could therefore modify the effective installation payload independently of this project's audited files. No evidence shows that the currently distributed package is malicious. This finding concerns the absence of version and integrity controls. ### Attack Path 1. An attacker gains control over the relevant npm package release process or distribution channel. 2. A malicious package version becomes the target of the mutable `latest` tag. 3. A user runs the README installation command. 4. `npx` downloads and executes the attacker-controlled release. 5. The payload performs actions available to the invoking user's account. ### Impact Assessment The maximum plausible impact is arbitrary code execution as the installing user. This may permit modification or theft of user-readable data, source code, development tokens, environment secrets, and other credentials. System-wide compromise would require the command to be run with elevated privileges or a separate privilege-escalation weakness. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions - Pin `clawhub` to a specifically reviewed version instead of using `@latest`. - Validate package provenance and integrity before execution. - Avoid running installation commands with administrator or root privileges. - Isolate installation from sensitive credentials where practical. - Review package scripts and executable behavior before recommending a new version. - Update the README and `SKILL.md` together so both documents reference the same immutable, audited release. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Session Persistence

Medium

• Category: Rogue Agent

Content

- Hub main loop for connection register/unregister/broadcast
- Lazy Redis subscriptions (subscribe only when first local client joins)
- Redis message forwarding to local WebSocket connections
- Connection write pump with ping/pong and batch draining
- Connection registry for horizontal scaling across instances
- Graceful shutdown with proper cleanup

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence
• Finding: The README instructs users to run `npx add` against a remote GitHub path without pinning to an immutable version, commit, or checksum. This creates a supply-chain risk because the referenced package or installer behavior can change over time, allowing future malicious or compromised content to be executed by users following the documentation.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence
• Finding: The command `npx clawhub@latest install websocket-hub-patterns` explicitly uses the floating `latest` tag, which can resolve to different code over time. If the package is compromised or a breaking/malicious update is published, users following the README may execute unreviewed code on their systems.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

From your project root:

```bash
mkdir -p .claude/skills
cp -r ~/.ai-skills/skills/realtime/websocket-hub-patterns .claude/skills/websocket-hub-patterns
```

• Confidence: 85% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

#### Claude Code (global)

```bash
mkdir -p ~/.claude/skills
cp -r ~/.ai-skills/skills/realtime/websocket-hub-patterns ~/.claude/skills/websocket-hub-patterns
```

• Confidence: 85% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

External Model or Provider Selection

Medium

• Category: Excessive Agency

Content

---
name: websocket-hub-patterns
model: standard
description: Horizontally-scalable WebSocket hub pattern with lazy Redis subscriptions, connection registry, and graceful shutdown. Use when building real-time WebSocket servers that scale across multiple instances. Triggers on WebSocket hub, WebSocket scaling, connection registry, Redis WebSocket, real-time gateway, horizontal scaling.
---

• Confidence: 90% confidence
• Finding: Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 88% confidence
• Finding: The installation command uses `npx clawhub@latest`, which fetches and executes the most recent package version at install time. This creates a supply-chain risk because a compromised upstream package, typosquat, or malicious newly-published version would be executed by users without review; the skill context makes this more dangerous because it explicitly instructs installation/execution of external tooling.

Static analysis

No suspicious patterns detected.