ClawHub
Back to skill

Security audit

uv-package-manager

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent uv package-manager guide, but it recommends several high-impact install patterns that execute or import mutable external code without verification.

Review before installing. The skill is a normal uv usage guide, but do not blindly copy the quick-install, CI, or Docker examples into a sensitive workstation or build environment. Prefer package-manager installs, pinned versions, pinned GitHub Action commits, pinned container digests, and checksum or signature verification where available.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (5)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:55
Finding

Remote Installation Scripts Executed Without Integrity Verification

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
SKILL.md:61
Finding

Unpinned Package and Git-Based Installation Sources

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
SKILL.md:383
Finding

GitHub Action Referenced Through a Mutable Major-Version Tag

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
SKILL.md:409
Finding

Docker Build Copies Executable From an Unpinned Latest Image

Content
View full analysis
Remediation
View remediation
`. - Record the human-readable release version in a nearby comment. - Verify image provenance and publisher signatures where supported. - Use a non-root runtime user and minimize build-time secret exposure. - Update the digest only through a reviewed dependency-update process. - Consider verifying the copied executable's checksum as an additional defense. ]]>

T08 · Insecure Dependencies

Warning
Location
SKILL.md:434
Finding

Multi-Stage Docker Build Uses an Unpinned Latest Image

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Rogue AgentSelf-Modification, Session Persistence
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (5)

Chaining Abuse

High
Category
Tool Misuse
Confidence
98% confidence
Finding

The | sh construct chains network retrieval directly into shell execution, eliminating any opportunity for review before code runs. This pattern is especially dangerous in instructional content because it encourages habitual execution of opaque remote code.

Content

Scanner excerpt · SKILL.md (reported line 55)May include surrounding context.

bash
# macOS/Linux
curl -LsSf https://astral.sh/uv/install.sh | sh

# Windows (PowerShell)
powershell -c "irm https://astral.sh/uv/install.ps1 | iex"

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High
Category
YARA Match
Confidence
75% confidence
Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · SKILL.md (reported line 680)May include surrounding context.

eEnvironment": true, "python.testing.pytestEnabled": true, "python.testing.pytestArgs": ["-v"], "python.linting.enabled": true, "python.formatting.provider": "black", "[python]": { "editor.defaultFormatter": "ms-python.black-formatter", "editor.formatOnSave": true } }

text

## Troubleshooting

### Common Issues

```bash
# Issue: uv not found
# Solution: Add to PATH or reinstall
echo 'export PATH="$HOME/.cargo/bin:$PATH"' >> ~/.bashrc

# Issue: Wrong Python version
# Solution: Pin version explicitly
uv python pin 3.12
uv venv --python 3.12

# Issue: Dependency conflict
# Solution: Check resolution
uv lock --verbose

# Issue: Cache issues
# Solution: Clear cache
uv cache clean

# Issue: Lockfile out of sync
# Solution: Regenerate
uv lock --upgrade

Best Practices

Project Setup

  1. Always use lockfiles for reproducibility
  2. Pin Python version with .python-version
  3. Separate dev dependencies from production
  4. Use uv run instead of activatin

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill instructs users to pipe a remotely fetched installer script directly into a shell, which executes unreviewed network content with the user's privileges. If the remote host, transport path, or script content is compromised, this becomes an immediate arbitrary code execution path.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 460)May include surrounding context.

Pattern 15: Lockfile Workflows

bash
# Create lockfile (uv.lock)
uv lock

# Install from lockfile (exact versions)

External Script Fetching

Low
Category
Supply Chain
Confidence
98% confidence
Finding

The command fetches an external script over the network and immediately executes it, giving remote content direct influence over the local system. In a developer-oriented skill, users are likely to copy-paste this verbatim, increasing the chance of supply-chain compromise or man-in-the-middle impact if trust assumptions fail.

Content

Scanner excerpt · SKILL.md (reported line 55)May include surrounding context.

bash
# macOS/Linux
curl -LsSf https://astral.sh/uv/install.sh | sh

# Windows (PowerShell)
powershell -c "irm https://astral.sh/uv/install.ps1 | iex"

Static analysis

No suspicious patterns detected.