Workflow Patterns

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 4:37 PM UTC
• Version: 1.0.0

Overview

This skill is a straightforward TDD workflow guide; its main risk is that the documented install commands use mutable npx sources, so users should install deliberately.

Before installing, prefer a pinned ClawHub package version or reviewed commit instead of @latest or a mutable GitHub path. Once installed, expect the skill to guide agents through tests, coverage checks, plan edits, and git commits, with explicit approval required at phase checkpoints.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: README.md:25

Finding

Unpinned Third-Party Code Execution During Installation

Content

View full analysis

Vulnerability Details

File Locations:

• README.md:25-32
• SKILL.md:21-23

Vulnerability Type: Unpinned and mutable third-party dependencies executed through npx
Risk Level: Medium

Vulnerable Code

README.md:25-32:

bash

npx add https://github.com/wpank/ai/tree/main/skills/meta/workflow-patterns

bash

npx clawhub@latest install workflow-patterns

SKILL.md:21-23:

bash

npx clawhub@latest install workflow-patterns

Technical Analysis

The documented installation commands instruct users to execute third-party content using npx. If a requested package is not already available locally, npx can retrieve and execute it, including its command-line entry point and potentially package lifecycle scripts.

The clawhub@latest dependency uses a mutable version selector rather than an audited, exact version. The GitHub-based command similarly references remote repository content without pinning it to a reviewed commit hash or verifying its integrity. Consequently, the code executed when a user follows these instructions can differ from the code available when this project was audited.

This does not establish that either current upstream source is malicious. The vulnerability is the lack of controls preventing a compromised registry account, package release, repository, branch, or transitive dependency from supplying altered executable content.

Attack Path

1. An attacker compromises the package publisher, package registry account, upstream repository, mutable release channel, or a dependency used by the installer.
2. The attacker publishes malicious code under the version resolved by @latest or changes the remotely referenced repository content.
3. A user follows one of the documented npx installation commands.
4. npx downloads the altered package or installer from the external source.
5. The downloaded CLI code or package lif ...[truncated 1052 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace clawhub@latest with an exact, reviewed package version:

   bash

   npx clawhub@<reviewed-exact-version> install workflow-patterns
   

2. Pin GitHub-hosted content to an immutable, reviewed commit hash rather than a mutable branch or repository path.

3. Publish and verify cryptographic checksums or signed release artifacts before installation.

4. Prefer a download, verification, and review workflow over immediately executing remotely resolved content.

5. Use lockfiles and package-manager integrity metadata for all direct and transitive dependencies where supported.

6. Document that installation should be performed without administrative privileges and in an isolated development environment.

7. Add an automated release process that verifies dependency provenance, signatures, integrity hashes, and the exact source revision associated with each documented installation command.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence

Finding

The README instructs users to execute a remote package/tool via npx add from a GitHub URL without any pinned version, tag, or commit digest. This creates a supply-chain risk because future changes to the referenced content could alter what gets installed or executed, and users cannot reproduce or verify the exact artifact they received.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 88% confidence

Finding

The command npx clawhub@latest install workflow-patterns pulls code at the moving latest version rather than an immutable release. If the upstream package is compromised or changes unexpectedly, users may execute different code than intended, making this a classic dependency/supply-chain exposure.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 42)May include surrounding context.

From your project root:

bash

mkdir -p .cursor/skills
cp -r ~/.ai-skills/skills/meta/workflow-patterns .cursor/skills/workflow-patterns

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 58)May include surrounding context.

From your project root:

bash

mkdir -p .claude/skills
cp -r ~/.ai-skills/skills/meta/workflow-patterns .claude/skills/workflow-patterns

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 65)May include surrounding context.

Claude Code (global)

bash

mkdir -p ~/.claude/skills
cp -r ~/.ai-skills/skills/meta/workflow-patterns ~/.claude/skills/workflow-patterns

External Model or Provider Selection

Medium

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: workflow-patterns
model: standard
version: 2.0.0
description: >
  Systematic task implementation using TDD, phase checkpoints, and structured commits.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

The installation command uses npx clawhub@latest, which fetches and executes the latest published package version at install time. This creates a supply-chain risk because a compromised or malicious newly published version could be executed without review or reproducibility controls.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 334)May include surrounding context.

md

| Making tests pass "too well" | Write minimum code only |
| Skipping refactor | Refactor is where quality happens |
| Ignoring coverage | Add tests until 80%+ |
| Proceeding without approval | Wait for explicit "approved" |

## Task Status Quick Reference

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/tdd-quick-reference.md (reported line 60)May include surrounding context.

md

| Making tests pass "too well" | Write minimum code only |
| Skipping refactor | Refactor is where quality happens |
| Ignoring coverage | Add tests until 80%+ |
| Proceeding without approval | Wait for explicit "approved" |

## Task Status Quick Reference

Static analysis

No suspicious patterns detected.