ClawHub
Back to skill

Security audit

Defuddle

Security checks for vulnerabilities and agentic risk

Overview

This skill mostly does webpage extraction, but it also can send extracted page content to WeChat or Telegram and runs an unpinned npm tool at runtime.

Install only if you are comfortable reviewing the scripts first, pinning or locally locking the Defuddle dependency, and manually confirming that any page content sent to WeChat or Telegram contains no sensitive, private, or regulated information.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
scripts/extract_and_send.sh:18
Finding

Unpinned npm Package Is Downloaded and Executed Through npx

Content
View full analysis

Vulnerability Details

File Location: scripts/extract_and_send.sh:18
Vulnerability Type: Unpinned third-party dependency execution
Risk Level: Medium

Vulnerable Code

bash
# Use defuddle to extract content as Markdown
CONTENT=$(npx defuddle parse "$URL" --markdown)

The same unsafe dependency pattern also occurs at:

  • scripts/extract_and_send_telegram.sh:18
  • scripts/extract_content.sh:22
  • SKILL.md:29
  • SKILL.md:86

Corresponding code includes:

bash
CONTENT=$(npx defuddle parse "$URL" --markdown)
bash
npx defuddle parse "$URL" $OUTPUT_FORMAT
bash
npx defuddle parse https://example.com/article --markdown
npm install -g defuddle

Technical Analysis

The project executes defuddle by package name without specifying an audited version. It also provides no package.json, lockfile, package integrity hash, or registry restriction. When an appropriate local executable is absent, npx may resolve and download the package from the configured npm registry before executing it. The globally documented installation is similarly unpinned.

Consequently, the code executed by these scripts can change after the Skill has been audited. A compromised package release, maintainer account takeover, or malicious dependency update could introduce arbitrary install-time or runtime code. This finding concerns unsafe dependency resolution; the audited files contain no evidence that the current defuddle package is itself malicious.

Attack Path

  1. An attacker compromises the defuddle package, its publisher account, a transitive dependency, or the registry path used by the victim.
  2. The attacker publishes a malicious version that contains an installation lifecycle script or malicious CLI implementation.
  3. A user runs one of the supplied extraction scripts on a system where a trusted local, pinned copy is unavailable.
  4. npx defuddle resolves or do ...[truncated 893 chars]
Remediation
View remediation

Remediation Suggestions

  1. Add a package.json that pins defuddle to a specific reviewed version rather than a range.

  2. Generate and commit a lockfile containing resolved versions and integrity hashes.

  3. Install dependencies in deployment or CI with npm ci, rather than downloading packages during each Skill invocation.

  4. Invoke the installed local executable directly, such as:

    bash
    ./node_modules/.bin/defuddle parse "$URL" --markdown

    Alternatively, define a fixed npm script that uses the locked local dependency.

  5. If npx must be retained, prevent implicit runtime installation and ensure only a locked local executable is used. Do not rely solely on an unversioned package name.

  6. Configure an approved registry and review package provenance, lifecycle scripts, publisher changes, and transitive dependencies before upgrades.

  7. Update SKILL.md to document a reproducible locked installation process and remove the unpinned global installation instruction.

  8. Apply the same remediation to all three scripts so no alternate execution path continues to download mutable code.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (16)

Rp1

Medium
Category
MCP Rug Pull
Confidence
91% confidence
Finding

The skill instructs users to run npx defuddle without pinning an exact package version. This creates a supply-chain risk because users may execute whatever version is current at install time, including a compromised or maliciously replaced release. In a skill that processes arbitrary web content, this raises the danger because users are encouraged to fetch and run code directly from the package registry.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
91% confidence
Finding

This example again uses npx defuddle without an explicit version, exposing users to unreviewed package updates and potential npm supply-chain compromise. Because npx may download and execute code immediately, an attacker controlling the package or a dependency could gain code execution on the user's system.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
91% confidence
Finding

The JSON example repeats the same unpinned npx pattern, which normalizes unsafe package execution practices for users. Repeated insecure examples increase the chance of real-world exploitation if the upstream package or dependency chain is ever hijacked.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The documentation presents the skill as a webpage-content extractor but also includes forwarding of extracted content to external messaging platforms. That mismatch increases security risk because users may reasonably expect local processing only, while the documented workflow enables outbound sharing of potentially sensitive data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill documents sending extracted content to WeChat and Telegram without any privacy, confidentiality, or data-handling warning. This omission is risky because users may unknowingly transmit proprietary, personal, or regulated information to third-party services, especially when scraping arbitrary webpages.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill goes beyond content extraction and documents scripts that send extracted material to WeChat and Telegram, introducing data-transfer and exfiltration capability unrelated to the core extraction function. This is dangerous because extracted content may contain sensitive or copyrighted information, and the skill provides no guardrails, consent flow, or destination validation.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
92% confidence
Finding

The script invokes npx defuddle without pinning a version, which allows whatever package version resolves at runtime to be downloaded and executed. In a shell script that processes attacker-controlled URLs, this creates a meaningful supply-chain risk because a compromised or malicious package update could run arbitrary code on the host.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The script fetches content from a user-supplied URL, converts it, and forwards the extracted content to a WeChat send script without any warning, confirmation, or filtering. This can cause unreviewed external content, including sensitive or deceptive material, to be transmitted to a messaging target, increasing data-handling and social-engineering risk.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
92% confidence
Finding

The script invokes npx defuddle without pinning an exact package version, so execution depends on whatever version is resolved at runtime. This creates a supply-chain risk: a compromised upstream release, typosquatted package, or unexpected breaking change could cause unreviewed code to execute when the script runs.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The script fetches content from an arbitrary URL and forwards the extracted text to Telegram, which is an external third-party service. Without an explicit warning, confirmation step, or data handling restrictions, users may unintentionally exfiltrate sensitive page contents, internal documents, or token-bearing pages to an external chat destination.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
81% confidence
Finding

The natural-language guidance in comments is written only in Chinese, which imposes a specific language without any opt-in or alternative for users. Under the stated policy, a language constraint should either be optional or clearly justified.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The script executes npx defuddle without pinning an exact package version, which can cause an unexpected or malicious package version to be downloaded and run at execution time. Because npx may fetch code from the registry on demand, this creates a supply-chain execution risk rather than merely a reliability issue.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

The natural-language content of the skill is entirely in Chinese, including the primary description and usage instructions, with no indication that this is a China-specific or Chinese-only skill and no opt-in for language preference. Under the policy, forcing a specific language without user choice or justification is a locale-policy issue.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

Comments, usage context, and the default contact name are all presented in Chinese, and the default recipient is the Chinese WeChat contact label 文件传输助手. This imposes a specific language/locale assumption without user opt-in or explanation that the skill is intentionally region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
87% confidence
Finding

The natural-language instructions and comments in the script are presented in Chinese, which may impose a language constraint on users without opt-in or justification. Under the policy, forcing a specific language without offering a choice can be a locale-policy violation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

This shell script makes an external network request by invoking defuddle parse on a user-supplied URL, but it provides no warning, prompt, or user-facing notice that remote content will be fetched. Aside from a usage string, there is no disclosure in comments or output about network access or its implications.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.