ClawHub
Back to skill

Security audit

poster generator

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent poster-generation guide, but it asks users or agents to install and run an unpinned external npm/GitHub package that was not included for review.

Review this before installing because the skill points to external, unpinned code rather than shipping the implementation for audit. Prefer a pinned npm version or reviewed commit, avoid npx and global installs when possible, do not use sudo unless you understand the system change, run it in a low-privilege workspace, and use fresh output paths for generated files.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
skill.md:76
Finding

Unpinned External Package Installation and Execution

Content
View full analysis
Remediation
View remediation
``` 4. Publish and verify cryptographic checksums or package signatures through a trusted channel. 5. Commit a lockfile and use `npm ci` for deterministic dependency installation. 6. Use `npm ci --ignore-scripts` where lifecycle scripts are unnecessary. If scripts are required, document and audit each script before execution. 7. Replace direct `npx` execution with a pinned package version and an explicit verification step. 8. Run the package in a sandbox or container with minimal filesystem access, no unnecessary credentials, restricted network access, and a non-privileged account. 9. Add automated dependency and provenance checks, such as lockfile auditing, registry provenance validation, and continuous monitoring for compromised or deprecated dependencies. ]]>

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (9)

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The invocation examples use broad natural-language requests like 'Design a poster' or 'Make Instagram posts,' which overlap with common creative-assistant prompts. In agent ecosystems, this can cause accidental or over-broad triggering of the skill, leading to unintended tool use, unreviewed file generation, or unexpected processing of user content.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill claims 'Local processing - no data sent to external servers' and 'No tracking or analytics,' but elsewhere explicitly documents network-reliant installation and package retrieval via npm and GitHub, and includes axios as a dependency. Even if runtime poster generation is local, the absolute security claim is misleading and can cause users or agents to trust the skill with sensitive inputs under false assumptions about network exposure and supply-chain risk.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · readme.md (reported line 461)May include surrounding context.

English:

bash
# Install system fonts
sudo apt-get install fonts-liberation

# Or specify custom font path
poster-gen create --font-path ./fonts/

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · readme.md (reported line 478)May include surrounding context.

English:

bash
# Install system fonts
sudo apt-get install fonts-liberation

# Or specify custom font path
poster-gen create --font-path ./fonts/

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · skill.md (reported line 297)May include surrounding context.

English:

bash
# Install system fonts
sudo apt-get install fonts-liberation

# Or specify custom font path
poster-gen create --font-path ./fonts/

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · skill.md (reported line 306)May include surrounding context.

English:

bash
# Install system fonts
sudo apt-get install fonts-liberation

# Or specify custom font path
poster-gen create --font-path ./fonts/

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
87% confidence
Finding

This markdown file documents poster-gen create and poster-gen batch commands that write generated posters to user-specified output files and directories, but it does not include any warning about file creation or possible overwriting of existing files. For markdown-scoped SQP-2 findings, user-facing documentation should disclose behaviors that affect user data or filesystem state.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.