ClawHub
Back to skill

Security audit

Elevation Data Point Path Charts Statistics

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent remote elevation lookup guide, with expected AgentPMT API use and no evidence of hidden local execution or malicious behavior.

Before installing, be aware that exact coordinates, paths, and generated chart requests are sent to AgentPMT and chart links may be stored for seven days. Prefer the ClawHub/OpenClaw install route or verify any `npx` package and source before running unpinned setup commands.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:276
Finding

Unpinned Third-Party Skill Installation Creates a Supply-Chain Risk

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 276–286
Vulnerability Type: Unpinned third-party dependencies from mutable upstream sources
Risk Level: Medium

Vulnerable Code

markdown
Core AgentPMT setup skills:
- What AgentPMT is: ../what-is-agentpmt
  - ClawHub page: https://clawhub.ai/agentpmt/what-is-agentpmt
  - OpenClaw install: `openclaw skills install what-is-agentpmt`
  - skills.sh install: `npx skills add AgentPMT/agent-skills --skill what-is-agentpmt`
- AgentPMT account MCP/REST setup: ../agentpmt-account-mcp-rest-api-setup
  - ClawHub page: https://clawhub.ai/agentpmt/agentpmt-account-mcp-rest-api-setup
  - OpenClaw install: `openclaw skills install agentpmt-account-mcp-rest-api-setup`
  - skills.sh install: `npx skills add AgentPMT/agent-skills --skill agentpmt-account-mcp-rest-api-setup`

skills.sh install script:

```bash
npx skills add AgentPMT/agent-skills --skill what-is-agentpmt
npx skills add AgentPMT/agent-skills --skill agentpmt-account-mcp-rest-api-setup
text

The recurring update instruction at `SKILL.md:14` further increases exposure:

```markdown
If the current date is more than 7 days after the last updated date, reinstall this skill from skills.sh or ClawHub before relying on endpoints, schemas, setup steps, or examples.

Technical Analysis

The documented setup executes an npm-distributed CLI through npx and installs Skill content from the mutable AgentPMT/agent-skills upstream repository. Neither the npm CLI version nor the repository revision is pinned. No checksum, cryptographic signature, or immutable release identifier is required.

Consequently, the effective installed content can change after this audited package has been reviewed. The seven-day reinstallation instruction encourages repeated retrieval of current upstream content, expanding the trust boundary beyond the two local Markdown files.

The remote elevation API itself is necessary for the declared hosted functionality. Se ...[truncated 1994 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin the npm CLI to a reviewed, immutable version, for example by using an exact package version rather than allowing npx to resolve the latest release.
  2. Pin AgentPMT/agent-skills to a specific commit hash or cryptographically signed release tag.
  3. Publish SHA-256 checksums or signed manifests and verify them before installation.
  4. Avoid instructions that automatically reinstall mutable content based only on elapsed time. Require explicit review and user approval for updates.
  5. Vendor the minimal reviewed setup guidance into the package where licensing and maintenance requirements permit.
  6. Configure installation tooling to reject unexpected repository redirects, package ownership changes, and unsigned releases.
  7. Document the external components installed, their required permissions, and whether installation can execute local lifecycle scripts.
  8. Run dependency installation with the lowest practical privileges and in an isolated environment.
  9. Maintain a lockfile or equivalent manifest recording exact dependency and Skill revisions.
  10. Re-audit dependency updates before promoting them to production.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (11)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill is designed to send user-supplied coordinates and route/path data to an external AgentPMT-hosted service, but it does not clearly warn that this location data leaves the local environment. Coordinates and travel paths can be sensitive, revealing homes, worksites, movement patterns, or planned travel routes, so omission of explicit disclosure creates a privacy and informed-consent issue.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
83% confidence
Finding

The skill instructs users to run npx skills ... without pinning a specific package version or immutable source. That creates a supply-chain risk: a future compromised or malicious package release could be executed in the user's environment during installation.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
83% confidence
Finding

This installation instruction uses npx skills without version pinning, so the command may fetch and execute whatever package version is current at install time. If the package or its dependency chain is hijacked, users could run attacker-controlled code.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
83% confidence
Finding

The referenced npx skills command is unpinned and therefore depends on mutable upstream package state. That exposes users to package substitution or malicious update risk at the moment they follow the skill's setup instructions.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
83% confidence
Finding

Because npx skills is invoked without a fixed version, the skill encourages execution of code that may change over time outside the document's control. In a compromised registry or maintainer account scenario, this can become arbitrary code execution on the installer host.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
83% confidence
Finding

Another unpinned npx skills install command appears here, carrying the same software supply-chain exposure. Users who trust the skill may run it directly, giving any malicious upstream package code execution opportunities.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
83% confidence
Finding

This unversioned npx skills example inherits the standard risk of executing an arbitrary latest package version from the registry. The danger is amplified because it is presented as a copy-pasteable install command in a trusted skill document.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
83% confidence
Finding

The command at this line also uses npx skills without a version constraint, making the installation path mutable and vulnerable to upstream compromise. Executing such commands can expose the local environment to malicious package lifecycle scripts or payloads.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 346)May include surrounding context.

md
- What AgentPMT is: ../what-is-agentpmt (ClawHub: `what-is-agentpmt`, page: https://clawhub.ai/agentpmt/what-is-agentpmt; skills.sh: `npx skills add AgentPMT/agent-skills --skill what-is-agentpmt`)
- AgentPMT account MCP/REST setup: ../agentpmt-account-mcp-rest-api-setup (ClawHub: `agentpmt-account-mcp-rest-api-setup`, page: https://clawhub.ai/agentpmt/agentpmt-account-mcp-rest-api-setup; skills.sh: `npx skills add AgentPMT/agent-skills --skill agentpmt-account-mcp-rest-api-setup`)
- Marketplace product: https://www.agentpmt.com/marketplace/elevation-data-point-path-charts-statistics
- AgentPMT main MCP server: https://api.agentpmt.com/mcp/
- AgentPMT REST invoke endpoint: https://api.agentpmt.com/products/purchase

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 347)May include surrounding context.

md
- What AgentPMT is: ../what-is-agentpmt (ClawHub: `what-is-agentpmt`, page: https://clawhub.ai/agentpmt/what-is-agentpmt; skills.sh: `npx skills add AgentPMT/agent-skills --skill what-is-agentpmt`)
- AgentPMT account MCP/REST setup: ../agentpmt-account-mcp-rest-api-setup (ClawHub: `agentpmt-account-mcp-rest-api-setup`, page: https://clawhub.ai/agentpmt/agentpmt-account-mcp-rest-api-setup; skills.sh: `npx skills add AgentPMT/agent-skills --skill agentpmt-account-mcp-rest-api-setup`)
- Marketplace product: https://www.agentpmt.com/marketplace/elevation-data-point-path-charts-statistics
- AgentPMT main MCP server: https://api.agentpmt.com/mcp/
- AgentPMT REST invoke endpoint: https://api.agentpmt.com/products/purchase

Vague Triggers

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The activation list includes phrases like "get elevation" and "locations," which are common, underspecified terms rather than narrowly scoped invocation triggers. In a manifest/skill description, such broad keywords can increase the chance of unintended invocation when a user is discussing maps, travel, or geography more generally.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.