ClawHub
Back to skill

Security audit

ContextCrumb

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent guide for using ContextCrumb to compress large local text files, with a supply-chain caution around unpinned PyPI commands.

Install from a trusted source, prefer pinning contextcrumb to a reviewed version or using a vetted environment, and run it with only the file access needed for the document being compressed. Treat compressed output as orientation, not authoritative text.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:46
Finding

Unpinned Third-Party Package Retrieval and Execution

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 46–56
Vulnerability Type: Unpinned third-party dependency retrieval and local execution
Risk Level: Medium

Vulnerable Code

powershell
uvx --from contextcrumb contextcrumb load <file>
powershell
python -m pip install contextcrumb

Technical Analysis

The documented bootstrap commands resolve the contextcrumb package by name from the configured Python package index without specifying an exact version, cryptographic hash, lockfile, or verified source. The uvx command retrieves and immediately executes the resolved package. The pip install command installs a dynamically selected release and may execute package build or installation logic.

Consequently, the code executed by users or agents can differ from the content reviewed during this audit. A compromised package release, transitive dependency, package repository, or resolver configuration could introduce attacker-controlled code. This is a supply-chain risk even though the audited project itself does not contain an embedded executable payload.

Attack Path

  1. An attacker compromises the contextcrumb package, one of its transitive dependencies, or the package source used by the local Python resolver.
  2. The attacker publishes or causes resolution of a malicious package release.
  3. A user or agent follows the documented uvx --from contextcrumb ... or python -m pip install contextcrumb instruction.
  4. The package is retrieved without version or hash verification.
  5. Malicious package, build, installation, or runtime code executes with the privileges of the invoking process.
  6. The malicious code can access the document passed to the tool and other files, credentials, network resources, or process-accessible data permitted to that user.

Impact Assessment

Successful exploitation provides code execution with the invoking user's privileges. The affected ...[truncated 464 chars]

Remediation
View remediation

Remediation Suggestions

  • Pin the dependency to a reviewed, exact version rather than resolving the latest available release by package name.
  • Use a lockfile or requirements file with cryptographic hashes, and require hash verification during installation.
  • Document and validate the package's official repository and trusted distribution source.
  • Pin and verify transitive dependencies as well as the direct package.
  • Avoid automatic one-off execution of dynamically resolved packages through uvx in security-sensitive environments.
  • Prefer a bundled and audited implementation, a vetted internal package mirror, or a prebuilt environment whose dependencies were reviewed before deployment.
  • Run the utility in a sandbox with minimal filesystem, credential, and network access.
  • Establish a controlled dependency-update process that reviews new versions before changing the pin.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Rp1

Medium
Category
MCP Rug Pull
Confidence
93% confidence
Finding

The skill instructs users to execute uvx --from contextcrumb contextcrumb load <file> without pinning a specific package version. That means the tool fetched and executed can change over time, and if the package or its dependency chain is compromised, an agent or user may run unreviewed code. In this skill, the risk is elevated because the command is presented as a recommended default path for one-off use.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
90% confidence
Finding

This line again recommends uvx --from contextcrumb contextcrumb load <file> without a pinned version, creating a supply-chain risk from fetching the latest package at execution time. Because the skill is meant to guide agent behavior, repeating the unsafe invocation increases the chance that automated workflows will adopt it directly.

Content

No source excerpt is available for this finding.