ClawHub
Back to skill

Security audit

Search For Service

Security checks for vulnerabilities and agentic risk

Overview

This skill has a clear marketplace-search purpose, but it runs an unpinned npm package and can probe arbitrary URLs with mutating HTTP methods.

Review before installing. The skill is not shown to be malicious, but it should pin the npm package to a reviewed version, narrow its invocation criteria, and restrict endpoint inspection to trusted public HTTPS URLs with explicit user control before using methods that can change server state.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Error
Location
SKILL.md:6
Finding

Execution of an Unpinned, Mutable npm Package

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 6
Vulnerability Type: Supply-chain risk through a dynamically resolved third-party dependency
Risk Level: High

Vulnerable Code

yaml
allowed-tools: ["Bash(npx awal@latest x402 bazaar *)", "Bash(npx awal@latest x402 details *)"]

The package is subsequently invoked as documented:

bash
npx awal@latest x402 bazaar search <query> [-k <n>] [--force-refresh] [--json]
npx awal@latest x402 details <url> [--json]

Technical Analysis

The skill authorizes npx to execute awal@latest. The latest tag is mutable and can resolve to a different package version each time the command is invoked. If the requested version is not already available locally, npx can retrieve and execute it from the npm registry.

The repository contains no lockfile, integrity hash, vendored package, exact version constraint, or package provenance verification. Consequently, the effective executable code can change after this skill has been audited without any corresponding modification to SKILL.md.

This creates a supply-chain execution boundary in which compromise of the package, its publisher account, the registry distribution path, or a future release can introduce arbitrary code.

Attack Path

  1. An attacker compromises the awal package, its publisher credentials, or another part of its release pipeline.
  2. The attacker publishes a malicious version and assigns it to the npm latest distribution tag.
  3. The agent invokes one of the authorized npx awal@latest commands.
  4. npx resolves and potentially downloads the attacker-controlled release.
  5. Package installation hooks or executable entry points run with the permissions of the account operating the agent.
  6. The malicious package can access files, environment variables, network resources, and other capabilities available to that account.

Impact Assessment

Succe ...[truncated 473 chars]

Remediation
View remediation

Remediation Suggestions

  1. Replace awal@latest with an exact, reviewed version such as awal@x.y.z.
  2. Commit a lockfile containing resolved versions and integrity hashes.
  3. Install dependencies during a controlled setup or build phase rather than downloading them during skill execution.
  4. Verify package provenance, publisher identity, registry signatures, and release integrity before upgrades.
  5. Disable or tightly control npm lifecycle scripts where they are not required.
  6. Run the command in a sandbox with restricted filesystem access, a minimal environment, and limited outbound networking.
  7. Establish an explicit dependency-update review process so version changes trigger a new security audit.

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:42
Finding

Unrestricted URL Probing with State-Changing HTTP Methods

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 42-47
Vulnerability Type: Unrestricted outbound request target and unsafe automatic HTTP method probing
Risk Level: Medium

Vulnerable Code

markdown
### Discover Payment Requirements

Inspect an endpoint's x402 payment requirements without paying:

```bash
npx awal@latest x402 details <url> [--json]

Auto-detects the correct HTTP method (GET, POST, PUT, DELETE, PATCH) by trying each until it gets a 402 response, then displays price, accepted payment schemes, network, and input/output schemas.

text

### Technical Analysis

The documented command accepts an unrestricted URL and automatically tries multiple HTTP methods, including the potentially state-changing `POST`, `PUT`, `DELETE`, and `PATCH` methods. The skill does not specify validation of the URL scheme, destination host, resolved IP address, port, redirect destination, or network range.

Consequently, an untrusted URL could direct the tool toward loopback interfaces, private networks, link-local addresses, cloud metadata services, or other services reachable from the agent host. Trying mutating methods also violates the expectation that inspection is read-only. A target that performs an operation before authentication, uses weak access controls, or interprets an empty request as a valid action could be modified merely by being inspected.

The exact behavior ultimately depends on the external `awal` implementation and the target service. Nevertheless, the skill explicitly instructs the package to attempt these methods and documents no safeguards.

### Attack Path

1. An attacker or untrusted task supplies a URL controlled by the attacker or referencing a service reachable only from the agent's network.
2. The agent runs `npx awal@latest x402 details` with that URL.
3. The tool resolves and connects to the supplied destination.
4. It sequentially attempts methods including `POST`, 
...[truncated 1010 chars]
Remediation
View remediation

Remediation Suggestions

  1. Accept only explicitly permitted https URLs.
  2. Resolve and validate destination addresses before connecting; reject loopback, private, link-local, multicast, unspecified, and cloud metadata address ranges.
  3. Revalidate every redirect target and resolved address to prevent redirect- and DNS-rebinding-based bypasses.
  4. Restrict outbound ports and use an allowlist of approved x402 marketplace domains where feasible.
  5. Use only HEAD, OPTIONS, or GET for automatic discovery.
  6. Never automatically issue POST, PUT, PATCH, or DELETE. Require explicit user approval, a trusted destination, and a preview of the exact request before using a mutating method.
  7. Apply short timeouts, response-size limits, redirect limits, and outbound network sandboxing.
  8. Avoid forwarding ambient credentials, cookies, authorization headers, or other sensitive metadata to user-supplied destinations.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (12)

Vague Triggers

High
Category
Not specified by scanner
Confidence
96% confidence
Finding

The description contains broad trigger phrases such as 'also use as a fallback when no other skill clearly matches' and generic prompts like 'what can I do?' or 'search for...'. This can cause the skill to activate for many unrelated requests, unexpectedly granting access to external package execution and bazaar search behavior in contexts where a safer or more specific skill should be used.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
98% confidence
Finding

This duplicate manifest finding points to the second unpinned allowed-tools entry using npx awal@latest. Multiple unpinned permissions expand exposure by authorizing several command families whose implementation can change unexpectedly upstream.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
98% confidence
Finding

This duplicate finding refers to the same unpinned npx awal@latest tool permission in the manifest. Using @latest means the executed code can change over time without review, enabling remote code execution through package compromise or malicious updates.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
96% confidence
Finding

The documentation instructs use of npx awal@latest, reinforcing execution of an unpinned package. Even in docs, this increases the chance maintainers and downstream systems copy insecure invocation patterns that can silently pull changed code.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
96% confidence
Finding

This command example uses npx awal@latest, preserving the same supply-chain risk in usage guidance. Because the skill is explicitly intended for routine marketplace searches, repeated use increases exposure to whatever code the package publisher serves at the time of execution.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
96% confidence
Finding

The endpoint inspection example again relies on an unpinned npx package. Since this command may be used on arbitrary URLs, combining dynamic package execution with outbound network interaction broadens the blast radius of a compromised package.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The documentation says endpoint details can be inspected without warning that the command may send requests to arbitrary external URLs and probe multiple HTTP methods until a 402 response is found. In an agent setting, this can lead to unintended outbound network traffic, SSRF-like behavior against internal/restricted endpoints if inputs are not constrained, or side effects on third-party services.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
96% confidence
Finding

The example for searching weather APIs repeats the unpinned npx awal@latest pattern. While an example line is less dangerous than the manifest permission itself, it still propagates an unsafe operational practice that can lead to execution of attacker-controlled package code.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
96% confidence
Finding

This example command uses @latest, leaving the actual executed code uncontrolled and mutable over time. The issue is especially relevant in agent skills because examples often become copied verbatim into operational workflows.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
96% confidence
Finding

The list command example includes npx awal@latest, continuing the same supply-chain exposure. Because this skill is user-invocable and intended as a broad discovery tool, insecure examples are likely to be exercised frequently.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
96% confidence
Finding

The details-checking example again uses an unpinned package. In this skill context, operators may run it against arbitrary external services, so any malicious package update could combine with network access to exfiltrate data or perform unintended outbound actions.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
96% confidence
Finding

This occurrence continues the pattern of advertising unpinned npx execution. Although individually repetitive, each instance increases the chance of insecure copy-paste usage and indicates the insecure pattern is systemic rather than incidental.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.