ClawHub
Back to skill

Security audit

GInstall OneClick

Security checks for vulnerabilities and agentic risk

Overview

This skill is clearly meant to install GitHub projects, but it can run untrusted setup code through an unpinned external CLI with limited safety boundaries.

Use this only for repositories and ginstall binaries you trust. Prefer plan-only mode first, review package scripts and dependency sources, avoid --yes for unknown repos, run in a disposable sandbox or container, and keep GITHUB_TOKEN out of the environment used by dependency installs or dev scripts.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Error
Location
SKILL.md:10
Finding

Unpinned and Ambiguous External CLI Creates a Supply-Chain Execution Risk

Content
View full analysis
``` ### Technical Analysis The skill does not contain the `ginstall` implementation. Instead, it trusts an externally installed executable named `ginstall` found through the host's `PATH`. The metadata identifies `https://github.com/ginstall-oneclick/ginstall-oneclick` as the homepage, while the installation instructions identify `https://github.com/YunzhouLi-hub/GInstall-OneClick` as the upstream source. This inconsistency makes it unclear which repository is authoritative. No release version, immutable commit, package digest, checksum, signature, or executable identity verification is specified. Consequently, the code that is ultimately executed can differ from the code reviewed with this skill. A compromised upstream repository, substituted installation source, or malicious executable placed earlier in `PATH` could execute attacker-controlled code. This risk is especially significant because the executable may receive access to the process environment, local workspace, Git credentials, and the optional `GITHUB_TOKEN`. ### Attack Path 1. An attacker compromises or impersonates one of the ambiguously documented upstream repositories, or places a malicious executable named `ginstall` earlier in the ...[truncated 1266 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:20
Finding

Non-Interactive Installation and Execution of Untrusted Repository Code

Content
View full analysis
" --yes --mode assisted --env-mode scan ``` ``` ```markdown 3. **Automation:** User wants CI setup with no prompts → `ginstall "owner/repo" --yes --mode assisted --env-mode scan` ``` ### Technical Analysis The declared workflow clones a user-selected GitHub repository, installs its Node.js dependencies, and starts a development-oriented script. The documented automation mode adds `--yes`, eliminating interactive approval prompts. A Node.js repository and its dependency graph are executable code. Package installation can trigger lifecycle hooks such as `preinstall`, `install`, and `postinstall`. Development commands can execute arbitrary commands defined in `package.json` or invoked by project tooling. These operations are therefore not equivalent to passive repository retrieval. The skill does not require inspection of the repository, lockfile, package scripts, dependency sources, or generated execution plan before automated execution. It also does not require a sandbox, network restriction, secret isolation, or filesystem boundary. Quoting the repository URL helps shell argument handling but does not mitigate malicious code contained in the selected repository or its dependencies. Although the token instructions require a minimum `contents:read` scope and prohibit posting the token in chat or shared plan files, an inherited `GITHUB_TOKEN` may still be readable by dependency hooks or development scripts if it remains ...[truncated 1750 chars]
Remediation
View remediation
" --mode manual --env-mode plan ``` 2. Require explicit user approval after displaying the exact clone, installation, and run commands. 3. Do not use `--yes` for repositories that have not been independently reviewed and allowlisted. 4. Inspect `package.json`, lockfiles, workspace configuration, and all lifecycle and development scripts before execution. 5. Initially install dependencies with lifecycle scripts disabled where supported, such as `npm install --ignore-scripts`, and authorize required scripts individually only after review. 6. Pin dependencies through a committed lockfile and reject unexpected registry, Git, URL, local-path, or mutable dependency sources. 7. Execute installation and development commands inside a disposable container or sandbox using an unprivileged account. 8. Mount only a dedicated workspace into the sandbox; do not mount home directories, SSH configuration, cloud credentials, or unrelated repositories. 9. Restrict outbound network access to destinations required for cloning and approved package retrieval. 10. Provide `GITHUB_TOKEN` only to the authenticated Git operation that requires it. Remove it from the environment before dependency installation or repository scripts run. 11. Apply a short execution timeout and explicit CPU, memory, process, and filesystem limits. 12. Preserve command and network logs so users can review what was executed. ]]>

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The README explicitly promotes a one-click workflow that clones arbitrary GitHub repositories, installs dependencies, and runs development scripts, but it does not prominently warn that these actions execute untrusted code and can modify the local system. In this skill context, that omission is security-relevant because npm install hooks and dev scripts are a common execution path for malicious packages or compromised repositories.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The description emphasizes 'one-click installs' but does not prominently warn that the workflow may execute package installation and developer-oriented run scripts from a third-party repository. This omission is dangerous because npm install hooks and dev scripts can run arbitrary code, making the skill materially riskier than a simple clone or download helper.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The trigger guidance includes broad natural-language phrases such as 'install this repo' and 'clone and run dev', which can cause the skill to activate in ordinary conversation without the user clearly consenting to a workflow that clones code, installs dependencies, and runs project scripts. In this skill's context, unintended activation is more dangerous because the downstream action chain executes untrusted repository setup steps on the user's machine.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
89% confidence
Finding

The skill documents non-interactive and auto-approval flags, including modes that can reduce or eliminate human review before clone/install/run actions proceed. In the context of a tool designed to fetch and execute setup workflows from GitHub repositories, autonomous approval increases the chance of silently executing malicious or unsafe project scripts.

Content

Scanner excerpt · SKILL.md (reported line 63)May include surrounding context.

md
| Flag / env | Role |
|------------|------|
| `--yes`, `CI`, `GINSTALL_NON_INTERACTIVE`, `GINSTALL_YES` | Non-interactive; auto-approve steps |
| `--mode` / `GINSTALL_MODE` | `manual` \| `guided` \| `assisted` \| `auto` |
| `--env-mode` / `GINSTALL_ENV_MODE` | `manual` \| `scan` \| `plan` |
| `--run-timeout` / `GINSTALL_RUN_TIMEOUT` | Dev/run step cap (seconds) |

Static analysis

No suspicious patterns detected.