ClawHub
Back to skill

Security audit

Clawford (Deprecated — use credara)

Security checks for vulnerabilities and agentic risk

Overview

This deprecated skill only points users to the Credara replacement and does not contain executable or hidden behavior, though the replacement install should be verified separately.

Treat this package as a deprecation pointer. Before following the Credara skill or SDK install commands, confirm the publisher, version, registry source, and permissions, and review those downstream packages separately.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
skill.md:3
Finding

Unpinned Third-Party Skill and SDK Installation

Content
View full analysis

Vulnerability Details

File Location: skill.md, lines 3-10
Vulnerability Type: Unpinned and externally mutable dependencies
Risk Level: Medium

markdown
This skill has been rebranded. Please install the updated version:

```bash
clawhub install credara

The Credara platform (formerly Clawford) is where AI agents prove competence, earn credentials, and trade skill packs.

text

### Technical Analysis

The documentation directs users to install the `credara` ClawHub skill and the `credara-sdk` npm package without specifying an audited version, immutable source revision, cryptographic checksum, or signature. These names therefore resolve to externally maintained and mutable artifacts whose future contents may differ from those available when this project was reviewed.

This is a supply-chain trust issue rather than evidence that the named packages are currently malicious. If either registry artifact or its publisher account is compromised, users following these instructions could install substituted code or agent instructions. The contents of the referenced dependencies are not included in this project and could not be audited.

### Attack Path

1. An attacker compromises the publisher account, registry entry, release pipeline, or another relevant upstream dependency for `credara` or `credara-sdk`.
2. The attacker publishes a modified release under the expected package or skill name.
3. A user follows `clawhub install credara` or `npm install credara-sdk` without selecting a reviewed, immutable version.
4. The package manager resolves the mutable current release and installs the attacker-controlled artifact.
5. Malicious behavior may then run through package installation hooks, later SDK use, or instructions and tools supplied by the installed skill.

### Impact Assessment

Exploitation could execute code with the privileges of the us
...[truncated 523 chars]
Remediation
View remediation

Remediation Suggestions

  • Pin each recommended dependency to a specific version that has been independently reviewed, such as an exact npm version rather than an unconstrained package name.
  • Where supported, reference an immutable source commit or content digest and provide a cryptographic checksum or publisher signature.
  • Document the expected official registry, verified publisher identity, source repository, and release provenance for both dependencies.
  • Generate and retain a lockfile with integrity metadata when integrating credara-sdk into a project.
  • Review package contents, transitive dependencies, lifecycle scripts, and requested permissions before installation.
  • Perform installation in a least-privileged, isolated environment without production credentials, and promote the artifact only after verification.
  • Review the redirected credara skill separately before recommending it as the replacement for this deprecated skill.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.