ClawHub
Back to skill

Security audit

fullstack-dev-engineer

Security checks for vulnerabilities and agentic risk

Overview

This is a broad full-stack development guide, but some copy-pasteable deployment, restore, and frontend examples could cause real operational or security risk without enough safeguards.

Review this skill before installing if you expect it to help with production systems. Treat its deployment, restore, and CI/CD snippets as templates only: pin package/action/container versions, use staging first, verify backups and targets, keep credentials out of local examples, and replace frontend localStorage token patterns with safer session handling.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (4)

T08 · Insecure Dependencies

Warning
Location
references/frontend-guide.md:20
Finding

Unpinned Vite Scaffolding Package Executes Mutable Third-Party Code

Content
View full analysis

Vulnerability Details

File Location: references/frontend-guide.md:20-22
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Complete Code Snippet:

bash
npm create vite@latest my-app -- --template react-ts
cd my-app
npm install

Technical Analysis

The @latest tag is mutable and does not identify an immutable, previously reviewed version of the Vite scaffolding package. Following this instruction causes npm to retrieve and execute the package version currently associated with that tag. Package initialization and dependency installation may execute package lifecycle scripts under the developer's account.

Because the effective dependency can change after the Skill has been reviewed, the instruction is not reproducible and transfers trust to the current state of the upstream package and npm registry. This behavior is relevant to the Skill's frontend-development purpose, but using a mutable version exceeds the minimum supply-chain trust necessary to provide scaffolding guidance.

Attack Path

  1. An attacker compromises the upstream package, maintainer account, publishing token, or package distribution channel.
  2. A malicious release becomes the version referenced by vite@latest.
  3. A user follows the guide and runs the scaffolding command.
  4. npm retrieves and executes the changed package under the user's local permissions.
  5. Malicious package code could read accessible project files or environment variables, alter generated source code, establish outbound connections, or compromise subsequent builds.

Impact Assessment

Exploitation could obtain the privileges of the developer running npm. The accessible scope may include the current project, user-readable files, environment variables, npm configuration and tokens, source-control credentials exposed to the process, and generated application code. No malicious package or active exploitation is present in the audited pr ...[truncated 58 chars]

Remediation
View remediation

Remediation Suggestions

  • Replace vite@latest with a reviewed, explicit version, such as vite@X.Y.Z.
  • Pin generated-project dependencies through a committed lockfile.
  • Use npm ci for repeatable installation after the lockfile has been created.
  • Review package provenance, signatures, lifecycle scripts, and release integrity before updating.
  • Use automated dependency-update tooling to propose reviewed version changes rather than resolving mutable tags at execution time.
  • Run untrusted scaffolding in a restricted container or disposable environment without production credentials.

T08 · Insecure Dependencies

Warning
Location
references/frontend-guide.md:44
Finding

Unpinned Vue Scaffolding Package Executes Mutable Third-Party Code

Content
View full analysis

Vulnerability Details

File Location: references/frontend-guide.md:44-46
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Complete Code Snippet:

bash
npm create vue@latest my-app
cd my-app
npm install

Technical Analysis

The command resolves vue@latest at execution time rather than selecting an immutable, audited package version. The retrieved scaffolding package and installed project dependencies may execute npm lifecycle code with the permissions of the developer.

A future upstream release, compromised maintainer account, or registry incident could therefore change the behavior of this documented command without any modification to the Skill. Project creation is within the Skill's declared functionality, but relying on a mutable tag is not necessary for that functionality.

Attack Path

  1. An attacker gains control of an upstream publishing account or compromises the package supply chain.
  2. A modified package is published and assigned to the latest tag.
  3. A user executes the documented npm create vue@latest command.
  4. The modified package runs during project creation or dependency installation.
  5. The package could steal process-accessible secrets, modify project files, inject dependencies, or compromise generated build configuration.

Impact Assessment

The malicious dependency would run with the invoking developer's privileges. Potentially exposed assets include project source code, environment variables, package-registry credentials, source-control credentials available to the process, and other user-readable files. The audited file does not itself include a malicious package or payload.

Remediation
View remediation

Remediation Suggestions

  • Replace vue@latest with a specific reviewed version.
  • Commit and enforce package lockfiles for generated applications.
  • Prefer npm ci in repeatable and automated environments.
  • Audit dependency provenance and lifecycle scripts before accepting updates.
  • Execute scaffolding without production secrets and, where practical, inside a sandbox or disposable container.
  • Use controlled update automation so version changes are explicitly reviewed.

T08 · Insecure Dependencies

Warning
Location
references/devops-guide.md:324
Finding

Deployment Jobs Use a Mutable Kubectl Container Image

Content
View full analysis

Vulnerability Details

File Location: references/devops-guide.md:324-338
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Complete Code Snippet:

yaml
deploy_staging:
  stage: deploy
  image:
    name: bitnami/kubectl:latest
  script:
    - kubectl config use-context staging
    - kubectl set image deployment/myapp myapp=$DOCKER_IMAGE:$CI_COMMIT_SHA
    - kubectl rollout status deployment/myapp
  environment:
    name: staging
    url: https://staging.example.com
  only:
    - main

deploy_production:
  stage: deploy
  image:
    name: bitnami/kubectl:latest

Technical Analysis

Both deployment jobs use bitnami/kubectl:latest. Container tags are mutable references and do not guarantee that CI will execute the same reviewed image on subsequent runs. A replaced or compromised image would execute inside deployment jobs where Kubernetes credentials and deployment context are expected to be available.

Kubectl access is legitimate for the declared deployment functionality. However, allowing the executable image to change without review unnecessarily expands supply-chain trust and can undermine least privilege because the image receives deployment credentials.

Attack Path

  1. An attacker compromises the image publisher, registry account, registry infrastructure, or mutable tag.
  2. The attacker publishes a modified image under bitnami/kubectl:latest.
  3. GitLab CI pulls the changed image for a staging or production deployment job.
  4. Malicious entrypoint or tool code executes before or during the deployment commands.
  5. The image accesses mounted CI variables, Kubernetes configuration, service-account credentials, or network-reachable cluster APIs.
  6. The attacker can perform operations allowed by the deployment identity and potentially tamper with workloads or exfiltrate available credentials.

Impact Assessment

The obtainable privileges ar ...[truncated 376 chars]

Remediation
View remediation

Remediation Suggestions

  • Pin the kubectl image by immutable digest, for example bitnami/kubectl@sha256:<reviewed-digest>.
  • If a version tag is retained for readability, combine it with a verified digest.
  • Verify image signatures and provenance through an admission or CI policy.
  • Restrict deployment credentials with namespace-scoped Kubernetes RBAC and separate staging from production identities.
  • Prevent deployment containers from receiving unrelated CI secrets.
  • Use an allowlisted registry and continuously scan pinned images.
  • Require explicit review before digest updates.

T08 · Insecure Dependencies

Warning
Location
references/devops-guide.md:753
Finding

Security Scanner GitHub Action Is Referenced by Mutable Master Branch

Content
View full analysis

Vulnerability Details

File Location: references/devops-guide.md:753-759
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Complete Code Snippet:

yaml
# 使用Clair扫描
clairctl analyze myapp:latest

# 集成到CI/CD
- name: Scan Docker image
  uses: aquasecurity/trivy-action@master
  with:
    image-ref: myapp:latest

Technical Analysis

aquasecurity/trivy-action@master references a mutable branch rather than an immutable Git commit. GitHub Actions execute code in the workflow runner and may have access to checked-out repository data, workflow tokens, artifacts, and secrets explicitly provided to the job. A later change to the branch therefore changes the effective code executed by the workflow without requiring a change to the consuming repository.

Image scanning is appropriate for the Skill's security-hardening functionality, but using a mutable branch is unnecessary. The myapp:latest image reference also weakens reproducibility because the scanned artifact may differ between runs.

Attack Path

  1. An attacker compromises the action repository, maintainer account, or publishing workflow, or succeeds in changing the referenced branch.
  2. Malicious code is introduced into the commit addressed by master.
  3. A consumer runs the documented CI workflow.
  4. GitHub Actions downloads and executes the changed action on the runner.
  5. The action reads repository content, available workflow context, tokens, artifacts, or explicitly exposed secrets.
  6. The attacker may exfiltrate available data, modify build artifacts, or tamper with workflow results.

Impact Assessment

Impact is limited by GitHub Actions token permissions, runner isolation, and secrets made available to the job. In a permissive workflow, exploitation could expose repository contents and tokens, modify artifacts, falsify scan results, or affect downstream publishing and deployment. No evidence shows that t ...[truncated 92 chars]

Remediation
View remediation

Remediation Suggestions

  • Pin the action to a reviewed full-length commit SHA rather than @master.
  • Record the corresponding release version in a comment for maintainability.
  • Pin the scanned container image by digest so the evaluated artifact is immutable.
  • Configure minimal GITHUB_TOKEN permissions and grant only the capabilities required for scanning.
  • Do not expose deployment or publishing secrets to the scan job unless strictly necessary.
  • Use dependency-update automation to submit reviewed SHA updates.
  • Verify action provenance and monitor upstream security advisories before updating.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (20)

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/best-practices.md (reported line 517)May include surrounding context.

POST /users # 创建用户 PUT /users/:id # 完整更新用户 PATCH /users/:id # 部分更新用户 DELETE /users/:id # 删除用户

text

#### 响应格式

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/devops-guide.md (reported line 273)May include surrounding context.

md
- name: Configure kubectl
      uses: azure/k8s-set-context@v3
      with:
        method: kubeconfig
        kubeconfig: ${{ secrets.KUBE_CONFIG }}

    - name: Deploy to Kubernetes

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/devops-guide.md (reported line 274)May include surrounding context.

md
- name: Configure kubectl
      uses: azure/k8s-set-context@v3
      with:
        method: kubeconfig
        kubeconfig: ${{ secrets.KUBE_CONFIG }}

    - name: Deploy to Kubernetes

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/devops-guide.md (reported line 808)May include surrounding context.

-n production

使用Sealed Secrets加密Secret

kubeseal -f secret.yaml -w sealed-secret.yaml

或使用External Secrets Operator引用外部密钥管理器

text

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/frontend-guide.md (reported line 115)May include surrounding context.

text

```bash
# .env
VITE_API_URL=https://api.example.com
VITE_APP_TITLE=My App

Unvalidated Output Injection

High
Category
Output Handling
Confidence
65% confidence
Finding

Model output is used without validation or sanitization. Unvalidated output injected into downstream contexts (SQL, shell, HTML) enables injection attacks and arbitrary code execution.

Content

Scanner excerpt · references/frontend-guide.md (reported line 629)May include surrounding context.

md
function renderUserContent(content: string) {
  return (
    <div
      dangerouslySetInnerHTML={{ __html: sanitizeHtml(content) }}
    />
  );
}

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill metadata description is broad enough to match a very wide range of ordinary software-development requests, which can cause the agent to invoke this skill in situations where a narrower or safer skill would be more appropriate. Over-broad routing increases the chance of unintended code generation, architecture advice, or deployment guidance being applied without sufficient user confirmation or task-specific safeguards.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The file presents the skill name, description, and instructions entirely in Chinese, with no indication that the user can choose another language. Under the stated policy, forcing a specific language without opt-in is a natural-language policy violation unless the locale restriction is explicitly justified.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The activation condition says the skill should trigger for many categories of requests, but it does not provide concrete constraints, disambiguation rules, or negative examples. In practice this can lead to over-activation, where general programming or advisory requests are routed into a powerful skill that may produce high-impact implementation or deployment instructions without sufficient scoping.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill includes deployment, CI/CD, containerization, monitoring, backups, and security hardening guidance, but it does not warn that these actions may change live systems, expose services, affect availability, or risk data integrity. In a full-stack and DevOps context, missing impact warnings and approval gates materially increases the chance that users follow unsafe operational instructions in production-like environments.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

This markdown file presents all instructional content in a single language, Chinese, and does not indicate that users may choose another language or that the document is intentionally limited to a Chinese-speaking audience. Under the language/locale policy, forcing a specific language without user opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

This markdown file presents all guidance in Chinese from the title onward, with no statement that the skill is China/Chinese-locale specific and no opt-in for language preference. The stated policy flags language or locale constraints when a skill forces a specific language without user choice or documented justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

This markdown file is a natural-language guidance document, and its title begins a document that continues entirely in Chinese. Under the policy criteria, forcing a specific language without user opt-in or documented locale justification is a language/locale policy violation.

Content

No source excerpt is available for this finding.

Cloud Storage Exfiltration

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is uploaded to cloud storage (S3 / GCS / Azure Blob). This may be a legitimate backup or exfiltration to an external bucket. Manual review is recommended.

Content

Scanner excerpt · references/devops-guide.md (reported line 833)May include surrounding context.

find $BACKUP_DIR -name "myapp_*.sql.gz" -mtime +$RETENTION_DAYS -delete

上传到S3

aws s3 cp $BACKUP_DIR/myapp_$DATE.sql.gz s3://my-backups/postgres/

text

#### Kubernetes资源备份

Cloud Storage Exfiltration

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is uploaded to cloud storage (S3 / GCS / Azure Blob). This may be a legitimate backup or exfiltration to an external bucket. Manual review is recommended.

Content

Scanner excerpt · references/devops-guide.md (reported line 861)May include surrounding context.

find $BACKUP_DIR -name "myapp_*.sql.gz" -mtime +$RETENTION_DAYS -delete

上传到S3

aws s3 cp $BACKUP_DIR/myapp_$DATE.sql.gz s3://my-backups/postgres/

text

#### Kubernetes资源备份

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The restore procedure performs clearly destructive actions: it scales the application down and pipes a backup directly into psql, which can overwrite live database state. Because the guide does not explicitly warn operators about downtime, data overwrite risk, or the need to validate the target environment and backup, it creates a real operational safety issue that can lead to accidental production impact.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

This markdown file contains user-facing instructional content exclusively in Chinese, starting from the title and continuing throughout the guide. Under the policy rule, forcing a specific language without user opt-in or documented regional justification is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

This is a real security issue in the guidance: the Pinia example persists an authentication token in localStorage, while the later security section correctly warns against doing so. In a developer skill, contradictory examples are dangerous because users may copy the insecure implementation directly, increasing exposure to token theft via XSS and weakening overall session protection.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill content consistently uses Chinese headings, instructions, and inline guidance, which effectively forces a specific language for all users. There is no note that the guide is region-specific, no opt-in for language preference, and no alternative language path.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

This markdown file contains user-facing instructional content exclusively in Chinese, beginning with the title and continuing throughout the document. Under the policy criteria, forcing a specific language without user opt-in can be a natural-language policy violation when no alternative language option or justification is provided.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.