ClawHub
Back to skill

Security audit

agent-builder-tool

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed AgentPMT integration for building and managing agents, with expected remote-service and account-data risks but no artifact-backed deception or hidden local execution.

Install only if you intend to use AgentPMT to create or manage agents. Review any prompts, context documents, IDs, and workflow/tool choices before sending them to AgentPMT, and prefer pinned or ClawHub-reviewed setup paths over unpinned npx commands.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:218
Finding

Unpinned Third-Party Skill Installation Creates a Mutable Supply-Chain Risk

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 218-232
Vulnerability Type: Unpinned third-party dependency installation
Risk Level: Medium

Vulnerable Code

markdown
Core AgentPMT setup skills:
- What AgentPMT is: ../what-is-agentpmt
  - ClawHub page: https://clawhub.ai/agentpmt/what-is-agentpmt
  - OpenClaw install: `openclaw skills install what-is-agentpmt`
  - skills.sh install: `npx skills add AgentPMT/agent-skills --skill what-is-agentpmt`
- AgentPMT account MCP/REST setup: ../agentpmt-account-mcp-rest-api-setup
  - ClawHub page: https://clawhub.ai/agentpmt/agentpmt-account-mcp-rest-api-setup
  - OpenClaw install: `openclaw skills install agentpmt-account-mcp-rest-api-setup`
  - skills.sh install: `npx skills add AgentPMT/agent-skills --skill agentpmt-account-mcp-rest-api-setup`

skills.sh install script:

```bash
npx skills add AgentPMT/agent-skills --skill what-is-agentpmt
npx skills add AgentPMT/agent-skills --skill agentpmt-account-mcp-rest-api-setup
text

### Technical Analysis

The Skill instructs users or agents to invoke an unpinned npm command and install Skill content from a mutable third-party repository. The version of the `skills` npm package is not fixed, and the `AgentPMT/agent-skills` source is not pinned to a reviewed commit hash or signed release.

Consequently, the content executed or installed when these commands are used can differ from what existed when this project was audited. The `npx` invocation executes package code during installation, while the installed Skills may introduce additional instructions, tool access, or executable components outside the reviewed two-file artifact.

The installation is not automatically performed by this Skill, which limits immediate exploitability. Exploitation requires a user or an agent to follow the documented setup instructions.

### Attack Path

1. An attacker compromises the npm package, its publisher account, 
...[truncated 1425 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin the npm CLI to a specifically reviewed version, for example by replacing an unversioned npx skills invocation with an explicitly versioned package reference.
  2. Pin AgentPMT/agent-skills to an immutable commit hash or cryptographically signed release rather than resolving the repository's current state.
  3. Publish and verify SHA-256 checksums or signed provenance for all downloaded Skill artifacts.
  4. Require users to inspect the resolved package version, repository revision, manifests, instructions, and scripts before activation.
  5. Use npm lockfiles and integrity metadata where the installation workflow supports them.
  6. Run installation in a sandbox with minimal filesystem access, no unnecessary credentials, and restricted outbound network access.
  7. Avoid directing an agent to install dependencies autonomously. Require explicit user confirmation before downloading, executing, or activating external content.
  8. Prefer vendoring reviewed setup documentation or dependencies into the release when feasible, followed by a security review of the vendored content.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (12)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The use-condition language says to use the skill when an agent needs this specific tool's behavior, but then immediately pairs that with generic search and activation keywords. That ambiguity can lead a routing system to treat common planning or agent-design conversations as authorization to call an external builder service, creating a confused-deputy style risk.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The activation keywords are broad phrases like building a custom AI agent or turning a job description into an agent, which can match many ordinary user requests and cause this skill to be invoked in contexts the user did not explicitly request. Overbroad activation increases the chance of unintended remote tool use and unnecessary transmission of user data to external services.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
84% confidence
Finding

The skill is explicitly designed to send agent data, prompts, configuration, and possibly attached context references to external AgentPMT endpoints. External transmission is expected product behavior here, but it still creates a real confidentiality and governance risk if sensitive user or organizational data is routed to the remote service without clear consent and data-minimization controls.

Content

Scanner excerpt · SKILL.md (reported line 285)May include surrounding context.

md
- What AgentPMT is: ../what-is-agentpmt (ClawHub: `what-is-agentpmt`, page: https://clawhub.ai/agentpmt/what-is-agentpmt; skills.sh: `npx skills add AgentPMT/agent-skills --skill what-is-agentpmt`)
- AgentPMT account MCP/REST setup: ../agentpmt-account-mcp-rest-api-setup (ClawHub: `agentpmt-account-mcp-rest-api-setup`, page: https://clawhub.ai/agentpmt/agentpmt-account-mcp-rest-api-setup; skills.sh: `npx skills add AgentPMT/agent-skills --skill agentpmt-account-mcp-rest-api-setup`)
- Marketplace product: https://www.agentpmt.com/marketplace/agent-builder-tool
- AgentPMT main MCP server: https://api.agentpmt.com/mcp/
- AgentPMT REST invoke endpoint: https://api.agentpmt.com/products/purchase

External Transmission

Medium
Category
Data Exfiltration
Confidence
84% confidence
Finding

The REST invoke endpoint is an external service boundary where user-supplied configuration and agent metadata may be transmitted outside the local environment. In context this is the core function of the skill, which makes the transmission legitimate, but also means accidental disclosure is plausible if users provide secrets, proprietary prompts, or internal context documents.

Content

Scanner excerpt · SKILL.md (reported line 286)May include surrounding context.

md
- AgentPMT account MCP/REST setup: ../agentpmt-account-mcp-rest-api-setup (ClawHub: `agentpmt-account-mcp-rest-api-setup`, page: https://clawhub.ai/agentpmt/agentpmt-account-mcp-rest-api-setup; skills.sh: `npx skills add AgentPMT/agent-skills --skill agentpmt-account-mcp-rest-api-setup`)
- Marketplace product: https://www.agentpmt.com/marketplace/agent-builder-tool
- AgentPMT main MCP server: https://api.agentpmt.com/mcp/
- AgentPMT REST invoke endpoint: https://api.agentpmt.com/products/purchase

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

This markdown schema documents an archive action that soft-deletes an agent and can add redirects, but it does not include a user-facing warning or caution about the operational impact of archiving. For markdown files, destructive or system-affecting behaviors should be clearly disclosed so users understand the consequences before invoking them.

Content

No source excerpt is available for this finding.