Lightweight charting skill: powerful styling & direct PNG export

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 5:44 AM UTC
• Version: 1.0.13

Overview

This charting skill is purpose-aligned, but users should be aware that it installs npm runtime dependencies and can persist chart style config changes.

Install only from a source you trust, prefer pinned installer versions, and run npm install/rendering without unnecessary secrets or elevated privileges. Treat the linked config page as external and avoid using confidential labels or business data there. Review any update-config payload before letting it overwrite persistent chart defaults.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: README.md:10

Finding

Unpinned npx Installers Allow Mutable Third-Party Code Execution

Content

View full analysis

Vulnerability Details

File Location: README.md:10-22
Vulnerability Type: Supply-chain exposure through unpinned executable packages
Risk Level: Medium

Vulnerable Code

bash

npx skills add ykforerlang/awesome-skills --skill data-charts-visualization

bash

npx skills add ykforerlang/awesome-skills --skill data-charts-visualization -g --copy -y

bash

npx clawhub@latest install data-charts-visualization

Technical Analysis

The documented installation process invokes executable npm packages through npx without pinning an exact reviewed version. The clawhub@latest command explicitly selects a mutable release, while npx skills implicitly resolves whichever package version satisfies npm's current default resolution.

Unlike downloading inert data, npx can retrieve and immediately execute package code. Therefore, the effective installer code may differ from the version that was available when this Skill was audited. The global unattended variant further increases exposure:

• -g installs into a global location.
• --copy causes files to be copied into the destination.
• -y suppresses interactive confirmation.

No malicious installer behavior was observed in the audited project itself. The vulnerability is the mutable, externally controlled code-execution path created by the documented commands.

Attack Path

1. An attacker compromises the npm account, publication pipeline, or package used by skills or clawhub.
2. The attacker publishes a malicious package version under the expected package name.
3. A user follows the installation command in README.md.
4. npx resolves and downloads the compromised version.
5. The package executes with the privileges of the invoking user.
6. With the global unattended command, the malicious installer can also modify global Skill files or other user-writable global locations without an additional confirmation prompt.

Impact Assessment

Successful exploitation per ...[truncated 646 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin every executable installer to an exact reviewed version:

bash

npx skills@<reviewed-version> add ykforerlang/awesome-skills --skill data-charts-visualization
npx clawhub@<reviewed-version> install data-charts-visualization

2. Remove @latest from security-sensitive installation instructions.
3. Prefer project-local installation over global installation.
4. Do not use -y in the default documented workflow; retain an explicit user confirmation step.
5. Publish expected package versions, registry sources, and integrity hashes in the installation documentation.
6. Recommend installation from a restricted, non-privileged account.
7. Where feasible, vendor or locally verify the installer before execution rather than combining retrieval and execution in one npx command.
8. Add a release process that tests and approves installer-version updates before changing the documented pin.

T08 · Insecure Dependencies

Warning

• Location: package.json:8

Finding

Runtime Installation Is Not Protected by a Dependency Lockfile

Content

View full analysis

Vulnerability Details

File Locations:

• package.json:8-9
• SKILL.md:132
• references/cli-and-config.md:24-29

Vulnerability Type: Non-reproducible dependency installation and npm lifecycle-script exposure
Risk Level: Medium

Vulnerable Code

package.json:8-9:

json

"dependencies": {
  "@areslabs/data-charts-visualization": "1.0.2"
}

SKILL.md:132:

text

- Before rendering, verify that `{baseDir}/node_modules/.bin/areslabs-data-charts` exists; if not, initialize the runtime with `cd {baseDir} && npm install`

references/cli-and-config.md:24-29:

bash

cd {baseDir} && npm install

text

This is the default entrypoint because it installs dependencies once and then executes the local CLI without a runtime network fetch.

Technical Analysis

The direct chart dependency is pinned to version 1.0.2, which is preferable to a floating direct version. However, the audited project does not contain a package-lock.json or another dependency lockfile.

Without a lockfile:

• Transitive dependency versions are not fixed by the audited artifact.
• Expected artifact integrity hashes are not recorded.
• Separate installations can resolve different transitive dependency graphs.
• npm install may execute lifecycle scripts supplied by dependencies.
• The actual executable CLI under node_modules/.bin/ is not part of the audited project and is obtained only during installation.

The Skill automatically instructs the Agent to run npm install when the local CLI is absent. Thus, ordinary chart rendering can trigger retrieval and execution of third-party package content that was not available for inspection in this audit.

No evidence establishes that @areslabs/data-charts-visualization version 1.0.2 is malicious. The confirmed weakness is the lack of reproducible, integrity-bound dependency resolution around code that is subsequently executed.

Attack Path

1. The local `node_modules/.bin/aresla ...[truncated 1294 chars]

Remediation

View remediation

Remediation Suggestions

1. Generate and commit a reviewed package-lock.json using a trusted npm registry.
2. Replace automated npm install with deterministic installation:

bash

npm ci

3. Review and retain the lockfile's integrity hashes in version control.
4. Configure npm to use an explicitly trusted registry and prevent unintended registry overrides.
5. Audit the complete dependency tree and package provenance before release.
6. Determine whether the runtime requires lifecycle scripts. If not, install with:

bash

npm ci --ignore-scripts

7. If lifecycle scripts are required, document them and verify their contents before allowing execution.
8. Run dependency installation and chart rendering in a restricted sandbox with:
   • No unnecessary secrets in the environment.
   • Minimal filesystem permissions.
   • Restricted outbound network access.
   • No administrative privileges.
9. Add automated dependency scanning and lockfile verification to the release pipeline.
10. Fail closed when the lockfile is absent or differs from the reviewed version rather than silently falling back to an unrestricted npm install.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (11)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

The README instructs users to run npx skills add ... without pinning a specific package version. Because npx resolves and executes the current published package, a compromised upstream package, typosquatted dependency, or malicious new release could result in arbitrary code execution on the user's machine during installation.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

This command again uses npx skills add ... without a pinned version, creating a supply-chain execution risk. Anyone following the README may execute whatever code the latest package version serves at install time, which is especially relevant because installation commands are highly trusted by users.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

npx clawhub@latest install ... explicitly tracks the latest release rather than a reviewed fixed version. That increases exposure to upstream compromise or a malicious/buggy release, allowing arbitrary code execution during install in environments likely to trust README setup steps.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The README tells users to open an external configuration page and paste the generated config back into chat, but it provides no warning about privacy, data sensitivity, or the trust boundary change. In a charting skill, configs may encode business metrics, labels, titles, or embedded sample data, so users could inadvertently disclose sensitive internal information to a third-party site and then reintroduce untrusted content into the agent workflow.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The README links to a third-party styling/configuration page as a convenience feature without warning that chart-related information may be sent outside the local environment. Because this skill is explicitly meant for reporting and dashboard generation, the omitted warning is more dangerous: users are likely to work with internal analytics, KPI names, and potentially sensitive operational data.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill explicitly directs the agent to write rendered output files to disk and, in the config update flow, to overwrite persistent configuration files under the skill directory. Even though some user consent language exists for persistence, the skill does not require a clear user-facing warning or explicit confirmation immediately before modifying files, which can lead to unintended local file changes or persistent state changes in an automation context.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The guidance tells the agent to state that copied config JSON will be written directly into a persistent chart config file, but it does not require an explicit confirmation step or warn that this changes future behavior. Because the file is persistent under the skill directory, a user-supplied config can silently alter later renders or affect subsequent users/workflows, making this a real state-changing risk rather than a harmless UX detail.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The post-handoff instructions explicitly direct the agent to write returned JSON directly into skills/data-charts-visualization/config/<chart>_style.json with no mandatory confirmation, validation, or isolation. This creates a direct path for untrusted user input to modify persistent skill state, which can lead to configuration poisoning, unexpected future outputs, and potentially abuse if downstream renderers interpret unsafe config fields.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The skill instructs the agent to run npm install if the runtime is missing, which introduces network access and third-party package retrieval during normal execution. It also links to external config-page URLs without warning that user data or metadata may be exposed externally, creating avoidable privacy, supply-chain, and connectivity risks in restricted environments.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The guidance presents only two language-specific URLs labeled in Chinese and English, implying a fixed locale set for the config page. The document does not say the agent should ask the user for language preference before choosing one, which can conflict with a language/locale choice policy.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.