ClawHub
Back to skill

Security audit

rotifer-arena

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed Rotifer benchmarking workflow, but users should be careful because it runs Rotifer npm packages that are not pinned to exact versions.

Install only if you intend to run Rotifer Gene or Agent evaluations. Prefer pinning exact @rotifer/playground and @rotifer/mcp-server versions, avoid global installation when possible, and run evaluations in a low-privilege project or sandbox if the workspace contains sensitive code or credentials.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:16
Finding

Unpinned npm Packages Are Downloaded and Executed

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:16-18, SKILL.md:24-30, SKILL.md:225-227; repeated installation guidance at README.md:23-25
Vulnerability Type: Supply-chain risk from mutable, unpinned npm dependencies
Risk Level: Medium

Vulnerable Code

SKILL.md:16-18:

bash
npx @rotifer/playground --version

SKILL.md:24-30:

json
{
  "mcpServers": {
    "rotifer": {
      "command": "npx",
      "args": ["@rotifer/mcp-server"]
    }
  }
}

SKILL.md:225-227:

text
- CLI is installed: `npm i -g @rotifer/playground`, or invoke it as `npx @rotifer/playground`

README.md:23-25:

text
**Setup it does need**: a Rotifer workspace (`rotifer.json`), the CLI
(`npm i -g @rotifer/playground`), and — for Native Genes — the TS→WASM toolchain
that `rotifer doctor` checks.

Technical Analysis

The documented npx and npm install commands identify packages only by mutable npm names. They do not specify an exact reviewed version, lock the dependency graph, or provide an integrity value. Consequently, the code executed when a user follows these instructions is determined by the npm registry at execution time rather than by the audited Skill package.

The MCP configuration is especially sensitive because it starts @rotifer/mcp-server as a local server through npx. If the package is absent from the local npm cache, npx can retrieve it from the registry and immediately execute it. Installing @rotifer/playground globally similarly permits package installation scripts and later CLI runtime code to execute with the invoking user's operating-system privileges.

The package names are consistent with the project's documented purpose, and the audit found no evidence that they are currently malicious. The vulnerability is the absence of dependency pinning and integrity enforcement, which creates a mutable remote supply-chain execution path.

Atta

...[truncated 1575 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin every externally executed npm package to an exact reviewed version:
    bash
    npx --yes @rotifer/playground@1.2.1 --version
npx --yes @rotifer/mcp-server@<reviewed-exact-version>
  2. Pin the MCP configuration to the same reviewed exact version rather than using the package's mutable latest release.
  3. Prefer a project-local dependency installation backed by a committed lockfile over npm i -g. Use npm ci so resolution fails when the lockfile and manifest disagree.
  4. Verify npm package provenance, signatures, and integrity metadata before execution. Preserve expected integrity hashes in the controlled dependency workflow where practical.
  5. Review direct and transitive dependency changes before upgrading pinned versions.
  6. Require explicit user confirmation before the first package download or execution, clearly identifying the package, exact version, source registry, and requested capabilities.
  7. Disable npm lifecycle scripts during installation where compatible, and run the CLI in a restricted environment with only the filesystem and network access required for the evaluation.
  8. Avoid privileged execution and global installation. Use a dedicated low-privilege account or sandbox for evaluation workloads.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The skill instructs users to execute npx @rotifer/playground without pinning a specific package version, which means the code fetched and run can change over time. Because this skill is explicitly about running CLI commands with filesystem and network access, a compromised upstream package, typo-squatted replacement, or malicious new release could result in arbitrary code execution in the user's environment.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

This line again directs use of npx @rotifer/playground without version pinning, creating a supply-chain risk where the package retrieved at runtime may not be the one originally reviewed. In the context of a skill that encourages command execution and states the CLI may be fetched from npm if not installed, this materially increases the chance of executing unreviewed remote code with local project access.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The description advertises 'one-click' import, compilation, matching, battle execution, and report generation in broad terms without explicit invocation boundaries or clear limits on what inputs are acceptable. In a skill that also requests process execution, filesystem access, and outbound network access, ambiguous trigger language increases the chance the agent is invoked in inappropriate contexts or on attacker-supplied artifacts, expanding the attack surface.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.