ClawHub
Back to skill

Security audit

agentpmt-workflow-creator

Security checks for vulnerabilities and agentic risk

Overview

The skill matches its AgentPMT workflow-management purpose, but it should be reviewed because setup uses unpinned npx commands and some destructive workflow actions lack clear confirmation guidance.

Review this before installing. Prefer the OpenClaw or ClawHub install path over the unpinned npx examples, or verify and pin the installer and source revision yourself. Only allow agents to call delete, restore, publish, or update actions after explicit user approval and after checking the current draft revision and latest saved workflow state.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:355
Finding

Unpinned Third-Party Installer Execution

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 355–365 and 416–417
Vulnerability Type: Unpinned third-party dependencies and mutable installation sources
Risk Level: Medium

Vulnerable Code Snippet

text
- What AgentPMT is: ../what-is-agentpmt
  - ClawHub page: https://clawhub.ai/agentpmt/what-is-agentpmt
  - OpenClaw install: `openclaw skills install what-is-agentpmt`
  - skills.sh install: `npx skills add AgentPMT/agent-skills --skill what-is-agentpmt`
- AgentPMT account MCP/REST setup: ../agentpmt-account-mcp-rest-api-setup
  - ClawHub page: https://clawhub.ai/agentpmt/agentpmt-account-mcp-rest-api-setup
  - OpenClaw install: `openclaw skills install agentpmt-account-mcp-rest-api-setup`
  - skills.sh install: `npx skills add AgentPMT/agent-skills --skill agentpmt-account-mcp-rest-api-setup`

skills.sh install script:

```bash
npx skills add AgentPMT/agent-skills --skill what-is-agentpmt
npx skills add AgentPMT/agent-skills --skill agentpmt-account-mcp-rest-api-setup
text

The equivalent unpinned `npx` installation references are repeated at lines 416–417.

### Technical Analysis

The documented `npx skills add` commands may download and execute the currently resolved version of the `skills` npm package. They then install content from the mutable `AgentPMT/agent-skills` repository reference. The commands pin neither an exact npm package version nor a repository commit and provide no checksum or signature verification.

Consequently, the code actually processed during setup can change after this Skill has been reviewed. This creates a supply-chain boundary in which compromise of the npm package, its maintainer account, the package registry, or the referenced upstream repository could expose users to attacker-controlled installer behavior.

The remote AgentPMT MCP and REST communication described elsewhere in the Skill is consistent with its declared workflow-management functionality. No hidden credential-exfiltration behavior w
...[truncated 1609 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin the skills npm package to an exact reviewed version rather than allowing npx to resolve the latest mutable release.
  2. Pin AgentPMT/agent-skills to a reviewed commit hash or immutable signed release tag.
  3. Publish cryptographic checksums or signatures for installed artifacts and verify them before installation.
  4. Prefer a reviewed marketplace or package-manager installation flow that does not execute mutable third-party package code during resolution.
  5. Document the expected publisher identity and verification procedure so users can detect registry or repository substitution.
  6. Re-audit dependency updates before changing pinned versions or commit references.
  7. Where feasible, run installation in a restricted environment with minimal filesystem, credential, and network access.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (13)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 260)May include surrounding context.

md
Complete generated action schema: `./schema.md`.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The listed activation keywords include broad phrases like "automate multi step business processes," "chain tools together into reusable pipelines," and "skill id," which are not specific enough to this skill and could overlap with many unrelated requests. The file does not provide negative examples or tighter constraints to distinguish when this skill should activate versus other workflow or automation skills.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
87% confidence
Finding

The skill instructs users to install supporting skills via npx skills ... without pinning a package version or immutable source revision. This creates a supply-chain risk: a later compromised or malicious package release could be fetched and executed during installation, especially because npx may pull code dynamically at runtime.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
87% confidence
Finding

The referenced npx skills install command is not version-pinned, so consumers may execute whatever package version is current at install time. In a skill ecosystem that encourages remote setup, this increases the chance of unnoticed execution of tampered installer code or breaking changes.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
87% confidence
Finding

This unpinned npx skills command exposes users to package substitution and upstream compromise risks because the fetched code is not fixed to a reviewed version. Since installation commands are high-trust instructions, even benign documentation can become an execution vector if the package source changes.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
87% confidence
Finding

A second unpinned install command in the script block repeats the same supply-chain weakness: runtime retrieval of mutable code from an external registry. Repetition increases exposure because users may copy-paste the whole block without reviewing the package provenance.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
87% confidence
Finding

The reference section again recommends npx skills add ... without version pinning, preserving the same dynamic package execution risk. Because this appears in a trust-building reference area, users may assume the command is safe and current without validating what code will run.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
87% confidence
Finding

This final unpinned npx example remains vulnerable to upstream package compromise or unexpected installer behavior changes. In aggregate with the other instances, it indicates a documentation pattern that normalizes unsafe installation practices.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 419)May include surrounding context.

md
- What AgentPMT is: ../what-is-agentpmt (ClawHub: `what-is-agentpmt`, page: https://clawhub.ai/agentpmt/what-is-agentpmt; skills.sh: `npx skills add AgentPMT/agent-skills --skill what-is-agentpmt`)
- AgentPMT account MCP/REST setup: ../agentpmt-account-mcp-rest-api-setup (ClawHub: `agentpmt-account-mcp-rest-api-setup`, page: https://clawhub.ai/agentpmt/agentpmt-account-mcp-rest-api-setup; skills.sh: `npx skills add AgentPMT/agent-skills --skill agentpmt-account-mcp-rest-api-setup`)
- Marketplace product: https://www.agentpmt.com/marketplace/agentpmt-workflow-creator
- AgentPMT main MCP server: https://api.agentpmt.com/mcp/
- AgentPMT REST invoke endpoint: https://api.agentpmt.com/products/purchase

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 420)May include surrounding context.

md
- What AgentPMT is: ../what-is-agentpmt (ClawHub: `what-is-agentpmt`, page: https://clawhub.ai/agentpmt/what-is-agentpmt; skills.sh: `npx skills add AgentPMT/agent-skills --skill what-is-agentpmt`)
- AgentPMT account MCP/REST setup: ../agentpmt-account-mcp-rest-api-setup (ClawHub: `agentpmt-account-mcp-rest-api-setup`, page: https://clawhub.ai/agentpmt/agentpmt-account-mcp-rest-api-setup; skills.sh: `npx skills add AgentPMT/agent-skills --skill agentpmt-account-mcp-rest-api-setup`)
- Marketplace product: https://www.agentpmt.com/marketplace/agentpmt-workflow-creator
- AgentPMT main MCP server: https://api.agentpmt.com/mcp/
- AgentPMT REST invoke endpoint: https://api.agentpmt.com/products/purchase

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The schema documents a destructive delete action with no explicit warning, confirmation requirement, or note about irreversible loss of draft data. In an agent-executed workflow builder, this increases the chance that an LLM or automation will invoke deletion based on ambiguous user intent, causing unintended data loss.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The restore-published action states it restores the published snapshot into the current draft, but does not clearly warn that this overwrites current draft changes. In a workflow-authoring skill, an agent may treat restore as informational or reversible and unintentionally discard in-progress work.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The restore-version action restores a retained checkpoint into the current draft without an explicit overwrite warning. Because this skill manages reusable DAG workflows, unintended restoration could silently replace active draft logic, tool chains, or prompts and result in material workflow corruption or loss of work.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.