ClawHub
Back to skill

Security audit

rotifer-agent

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed Rotifer workflow guide that runs expected Rotifer CLI/MCP commands, with the main caution being unpinned npm execution.

Install only if you intend to use Rotifer. Before first use, review or pin the @rotifer/playground and @rotifer/mcp-server npm versions, and run them with only the project files and network access you are comfortable giving to the Rotifer CLI.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:18
Finding

Unpinned npm Packages Executed Through npx

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:18 and SKILL.md:29
Vulnerability Type: Unpinned third-party dependencies executed from the npm registry
Risk Level: Medium

Vulnerable Code

bash
npx @rotifer/playground --version
json
{
  "mcpServers": {
    "rotifer": {
      "command": "npx",
      "args": ["@rotifer/mcp-server"]
    }
  }
}

Technical Analysis

The documented commands execute @rotifer/playground and @rotifer/mcp-server without specifying exact package versions or validating package integrity. When these packages are absent from the local npm cache, npx can retrieve their current releases from the npm registry and execute them immediately.

Consequently, the code that runs may differ from the code available when this Skill was reviewed. A compromised publisher account, malicious package release, or upstream supply-chain compromise could place attacker-controlled code in the execution path.

Although the project does not itself contain malicious executable code, its manifest grants process:exec, filesystem:read, filesystem:write, and network:outbound permissions. A compromised npm package executing under this workflow could operate with the invoking user's effective OS privileges and the access available to the host agent.

Attack Path

  1. An attacker compromises the npm publisher account, release process, or package contents for @rotifer/playground or @rotifer/mcp-server.
  2. The attacker publishes a malicious version under the legitimate package name.
  3. A user or AI agent follows the instructions in SKILL.md, or starts the configured MCP server.
  4. Because no exact version is specified, npx retrieves or resolves the mutable package release.
  5. npx executes the compromised package locally.
  6. The malicious package can perform actions allowed by the invoking process, including reading or modifying accessible files, starting ...[truncated 494 chars]
Remediation
View remediation

Remediation Suggestions

  • Pin both npm packages to exact, reviewed versions, for example:
    bash
    npx --yes @rotifer/playground@<reviewed-exact-version> --version
    json
    {
  "mcpServers": {
    "rotifer": {
      "command": "npx",
      "args": [
        "--yes",
        "@rotifer/mcp-server@<reviewed-exact-version>"
      ]
    }
  }
}
  • Prefer declaring the packages in a committed package manifest and lockfile rather than downloading mutable releases at execution time.
  • Enforce lockfile integrity data and use deterministic installation such as npm ci.
  • Review package provenance, publisher identity, release signatures, and npm provenance attestations before approving a version.
  • Require explicit user approval before the first package download and before any dependency version change.
  • Run the CLI and MCP server in a sandbox with minimal filesystem access, restricted environment variables, no unnecessary credentials, and narrowly scoped outbound network access.
  • Periodically reassess pinned versions for known vulnerabilities before upgrading, and review each upgrade as a new executable dependency.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Rp1

Medium
Category
MCP Rug Pull
Confidence
91% confidence
Finding

The skill instructs users to execute packages via npx without pinning a specific version, which allows whatever package version is current at execution time to run on the user's machine. In a security-sensitive agent skill that also discusses process execution, filesystem access, and network access, this creates a real supply-chain risk: a compromised upstream release, typosquatted dependency path, or unexpected breaking change could lead to arbitrary code execution under the user's privileges.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The manifest requests a powerful combination of permissions: process execution, filesystem read/write, and outbound network access, but provides no user-facing disclosure about the scope, risks, or expected operations. This creates a meaningful abuse path because a mistakenly or broadly activated skill could run commands, modify local files, and exfiltrate data over the network without users understanding the system impact.

Content

No source excerpt is available for this finding.

Vague Triggers

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

The manifest description and tagline describe broad agent-building and orchestration capabilities without clearly constraining when the skill should activate or what it must not handle. In a skill-selection system, this ambiguity can cause over-broad invocation and expose high-risk capabilities such as command execution, file access, and outbound networking in contexts the user did not specifically intend.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.