ClawHub
Back to skill

Security audit

Model Citizen

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent but should be reviewed because it asks users to run mutable external npm and remote MCP code in an authority-delegation workflow.

Install only if you trust the AEOESS package and remote service, prefer exact pinned versions or a reviewed lockfile, run it in a least-privileged environment, and avoid exposing broad tokens or sensitive workspace data to the MCP server.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:40
Finding
Unpinned Third-Party npm Packages Permit Supply-Chain Code Execution<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:11-16`, `SKILL.md:40-45`, and `SKILL.md:51-58` **Vulnerability Type**: Unpinned executable third-party dependencies **Risk Level**: Medium ### Vulnerable Code ```yaml requires: bins: ["npx"] env: ["GITHUB_TOKEN (optional, only for register_agora_public)"] network: - "mcp.aeoess.com (remote MCP server, SSE mode)" - "api.aeoess.com (Intent Network API)" install: - id: node kind: node package: agent-passport-system bins: ["agent-passport"] ``` ```bash npm install agent-passport-system # SDK, /core subpath is the curated default npm install agent-passport-system-mcp # MCP server, APS_PROFILE=essential is the default ``` ```bash # Identity (passport + Ed25519 keypair, tied to the principal) npx agent-passport join --name my-agent --owner alice # Scoped authority (scope, spend limit, depth, expiry; only narrows) npx agent-passport delegate --to <publicKey> --scope web_search --limit 500 --depth 1 --hours 24 # Record work (Ed25519-signed receipt, traceable through the chain) npx agent-passport work --scope web_search --type research --result success --summary "..." ``` ### Technical Analysis The skill directs users to install `agent-passport-system` and `agent-passport-system-mcp` without exact versions, lockfile enforcement, or integrity verification. Package names without versions resolve to mutable registry releases. Consequently, the code installed at a future point may differ from the code originally reviewed. npm dependencies can execute package lifecycle scripts during installation. The documented `npx agent-passport` commands also explicitly execute package-provided code. If a package release, maintainer account, registry distribution channel, or transitive dependency is compromised, following these instructions could execute altered code on the local system. The project contains only documentation and metadata, with no vendored implementation, lockfile, ch ...[truncated 1582 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. Pin each package to a reviewed exact version rather than relying on the registry's current release: ```bash npm install --save-exact agent-passport-system@<reviewed-version> npm install --save-exact agent-passport-system-mcp@<reviewed-version> ``` 2. Provide and retain a lockfile containing resolved transitive dependency versions and integrity hashes. 3. Use `npm ci` in automated or reproducible environments instead of resolving dependencies dynamically with `npm install`. 4. Verify package provenance, publisher identity, signatures or attestations, and npm integrity metadata before installation. 5. Disable lifecycle scripts during acquisition where operationally possible by using `--ignore-scripts`, then explicitly review and run only required installation steps. 6. Invoke the locally installed, version-pinned executable rather than allowing `npx` to retrieve or resolve an unexpected package release. For example: ```bash ./node_modules/.bin/agent-passport join --name my-agent --owner alice ``` 7. Run package installation and CLI operations inside a least-privileged, isolated environment with narrowly scoped filesystem, network, and credential access. 8. Document a dependency update and security-review process so version changes are assessed before users receive revised installation instructions. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
## What this is not

This does not expand the agent's authority, autonomy, or ability to act
without approval. Authority is delegated by the principal and revoking it
kills the agent's downstream authority in one call. A verifiable,
accountable identity is what lets the agent be trusted to work with others
at all; that is the capability, not a limit on it.
Confidence
75% confidence
Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding
The skill instructs users to run `npx agent-passport` without pinning an exact package version, which can fetch and execute whatever version is currently published at invocation time. That creates a supply-chain risk where a compromised maintainer account, malicious update, or dependency hijack could result in arbitrary code execution in the agent environment.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding
This unpinned `npx agent-passport` invocation for delegation can execute a newly published or tampered package version at runtime. Because the command is used in a security-sensitive workflow involving delegated authority, compromise of the package path could directly affect credentials, scopes, or local environment secrets.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding
The `work` example also relies on unpinned `npx` execution, exposing users to the same package substitution and malicious update risks. In this context, the command handles signed receipt generation, so a malicious binary could falsify records, exfiltrate keys, or alter audit data.

Static analysis

No suspicious patterns detected.