ClawHub
Back to skill

Security audit

module-tsx

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent no-build TypeScript/React browser helper, but generated pages can fetch and run third-party CDN code unless users pin or self-host dependencies.

Use this skill mainly for prototypes, demos, and controlled browser apps. For production or sensitive pages, pin exact dependency versions, define explicit import maps, review the remote packages being executed, consider self-hosting or vendoring dependencies, and apply a restrictive Content Security Policy.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:18
Finding
Unpinned Remote Executable Dependencies<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:18-23`, `SKILL.md:73-79`, `SKILL.md:125-133`, and `SKILL.md:160-166` **Vulnerability Type**: Unpinned third-party browser dependencies and mutable CDN-hosted executable code **Risk Level**: Medium ### Vulnerable Code Snippets `SKILL.md:18-23`: ```markdown browser without a build step, or asks about module-tsx. It transpiles code on the fly and rewrites bare specifiers (like `"react"`) to `https://esm.sh/<pkg>` automatically. ## How to load it ```html <script type="module" src="https://esm.sh/module-tsx"></script> ``` ``` `SKILL.md:73-79`: ```html <script type="module" src="https://esm.sh/module-tsx"></script> ... <script type="module-tsx"> import { createRoot } from "react-dom/client"; import "@tailwindcss/browser"; ``` `SKILL.md:125-133`: ```html <script type="importmap"> { "imports": { "react": "https://esm.sh/react@18", "react-dom": "https://esm.sh/react-dom@18", "react-dom/": "https://esm.sh/react-dom@18/", "@radix-ui/themes": "https://esm.sh/@radix-ui/themes?deps=react@18,react-dom@18", "@radix-ui/themes/": "https://esm.sh/@radix-ui/themes/" } } </script> <script type="module" src="https://esm.sh/module-tsx"></script> ``` `SKILL.md:160-166`: ```html <script type="module" src="https://esm.sh/module-tsx/dev"></script> ``` ```html <script type="module" src="https://esm.sh/module-tsx"></script> ``` ### Technical Analysis The skill directs generated pages to execute JavaScript modules obtained from `esm.sh`. The primary `module-tsx` runtime is loaded without an exact version, and its automatic bare-specifier rewriting can resolve additional unpinned packages. The example import of `@tailwindcss/browser` is likewise unpinned. Some import-map entries use only the React major version, while the Radix UI entries specify no package version at all. These mutable dependency references prevent consumers from determining that the code executed in p ...[truncated 1992 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. Pin every remotely loaded package to an exact reviewed version rather than an unversioned or major-only reference. This includes `module-tsx`, React, React DOM, Tailwind Browser, and Radix UI. 2. Prefer immutable artifact URLs or content-addressed assets so previously reviewed content cannot change without a source update. 3. Apply Subresource Integrity to cross-origin scripts when the CDN and loading mechanism support stable integrity metadata. 4. For production deployments, self-host audited runtime and dependency artifacts instead of resolving mutable packages dynamically. 5. Avoid automatic production resolution of arbitrary bare specifiers. Define an explicit import map containing every approved dependency and exact version. 6. Generate and retain a dependency lockfile or manifest, including transitive dependency versions, as part of the review and deployment process. 7. Enforce a restrictive Content Security Policy that limits `script-src`, `connect-src`, and other relevant directives to required origins. 8. Establish dependency monitoring and a controlled update process so version changes are reviewed, tested, and deployed intentionally. 9. Document that the development CDN loader is suitable only for trusted development environments unless the remote artifacts are pinned and verified. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
91% confidence
Finding
The trigger text is broad enough to activate this skill for generic HTML-writing requests, not just explicit requests to run TypeScript/TSX in-browser. That can steer the agent toward emitting pages that load remote transpilation/runtime infrastructure and external packages unexpectedly, increasing supply-chain and unintended-execution risk in otherwise simple contexts.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill encourages loading code from esm.sh and resolving bare imports to CDN-hosted packages at runtime, but it does not warn users that this executes third-party code fetched on page load. Without an explicit warning, users may unknowingly accept integrity, availability, privacy, and supply-chain risks from external dependencies and on-the-fly rewriting/transpilation.

Static analysis

No suspicious patterns detected.