ClawHub
Back to skill

Security audit

AfrexAI Competitor Monitor

Security checks for vulnerabilities and agentic risk

Overview

This skill is a simple competitor-analysis prompt with no bundled code or automatic actions, though it includes optional third-party install recommendations users should treat cautiously.

Before following the optional `clawhub install` recommendations or buying the external context packs, verify the publisher, version, permissions, and trustworthiness of those separate resources. The core skill itself is just guidance for competitor research.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:66
Finding

Unpinned Third-Party Skill Installation Recommendations

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 66-68
Vulnerability Type: Supply-chain exposure through unpinned third-party skills
Risk Level: Medium

Complete Code Snippet:

markdown
- Lead scoring (adjust based on competitive landscape): `clawhub install afrexai-lead-scorer`
- SEO analysis: `clawhub install afrexai-seo-writer`
- Industry context: https://afrexai-cto.github.io/context-packs/ ($47/pack)

Technical Analysis

The skill recommends installing third-party skills by mutable package names without specifying immutable versions, integrity hashes, verified source repositories, publisher provenance, or expected permissions. Consequently, the content installed by these commands may differ from what was available when this skill was audited.

This creates a supply-chain trust boundary: compromise of the registry account, package namespace, distribution service, or a future package release could cause users to install attacker-controlled content. The external commercial link is also unverified, although the reviewed file does not instruct the agent to download or execute code from that URL.

No malicious implementation is embedded in the audited project, and the installation commands are recommendations rather than automatically executed operations. Exploitation therefore requires a user or agent to follow one of the recommendations and a referenced package to be compromised or malicious.

Attack Path

  1. An attacker compromises a referenced publisher account or otherwise gains control over a referenced package.
  2. The attacker publishes a malicious release under the same mutable package name.
  3. A user or agent follows the documented clawhub install command.
  4. The package manager resolves the uncontrolled current release because no version or integrity digest is specified.
  5. The malicious skill is installed and subsequently loaded or invoked.
  6. Its instructions or code oper ...[truncated 530 chars]
Remediation
View remediation

Remediation Suggestions

  • Remove optional installation recommendations unless they are necessary for the skill's core operation.
  • Pin every dependency to a reviewed immutable version or content digest rather than resolving the latest release by package name.
  • Publish the verified source repository, publisher identity, expected artifact hash, and review date for each recommended package.
  • Document the permissions and tools each dependency requires, and require explicit user approval before installation.
  • Verify package signatures and integrity metadata before loading installed content.
  • Re-audit dependency updates before changing pinned versions.
  • Run third-party skills in a least-privilege sandbox with restricted filesystem, network, credential, and tool access.
  • Treat the external commercial resource as untrusted content unless its provenance and integrity can be independently verified.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.