ClawHub
Back to skill

Security audit

Local Business Discovery And Mapping

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent remote mapping and place-search integration, with expected location-data sharing and some install hygiene cautions but no evidence of hidden or malicious behavior.

Install from ClawHub/OpenClaw when possible, inspect any related setup skills before adding them, and avoid sending precise home, workplace, or other sensitive addresses unless the mapping task requires it. Do not place AgentPMT credentials, wallet secrets, signatures, or payment headers in prompts or logs.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:317
Finding

Unpinned Third-Party Setup Dependencies

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 317-327
Vulnerability Type: Supply-chain risk from mutable, unverified dependencies
Risk Level: Medium

Vulnerable Code

markdown
- What AgentPMT is: ../what-is-agentpmt
  - ClawHub page: https://clawhub.ai/agentpmt/what-is-agentpmt
  - OpenClaw install: `openclaw skills install what-is-agentpmt`
  - skills.sh install: `npx skills add AgentPMT/agent-skills --skill what-is-agentpmt`
- AgentPMT account MCP/REST setup: ../agentpmt-account-mcp-rest-api-setup
  - ClawHub page: https://clawhub.ai/agentpmt/agentpmt-account-mcp-rest-api-setup
  - OpenClaw install: `openclaw skills install agentpmt-account-mcp-rest-api-setup`
  - skills.sh install: `npx skills add AgentPMT/agent-skills --skill agentpmt-account-mcp-rest-api-setup`

skills.sh install script:

```bash
npx skills add AgentPMT/agent-skills --skill what-is-agentpmt
npx skills add AgentPMT/agent-skills --skill agentpmt-account-mcp-rest-api-setup
text

### Technical Analysis

The Skill directs users to run `npx skills` and install mutable content from `AgentPMT/agent-skills` without specifying an audited package version, immutable repository commit, integrity hash, or signature. Consequently, the dependencies installed at execution time may differ from those originally reviewed.

This is especially sensitive because one dependency configures AgentPMT account MCP/REST connectivity. Although no malicious behavior was identified in the audited files themselves, compromise or unauthorized modification of the npm package, repository, publisher account, or distribution channel could introduce unreviewed setup instructions or executable behavior.

### Attack Path

1. An attacker compromises the package, source repository, publisher credentials, or another upstream distribution component.
2. The attacker modifies the package or setup Skill referenced by the unpinned commands.
3. A user foll
...[truncated 1434 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin the skills npm package to a specific, audited version rather than relying on the version resolved by an unqualified npx invocation.
  2. Pin AgentPMT/agent-skills to an immutable commit SHA or signed release tag.
  3. Publish and verify cryptographic checksums or signatures for downloaded Skill content.
  4. Use package lockfiles and integrity metadata where supported.
  5. Require users to inspect and approve the setup Skills before execution, particularly the account MCP/REST setup Skill.
  6. Run installation with least privilege and prohibit elevated or administrator execution unless explicitly required and justified.
  7. Document the expected dependency versions and provide a process for reviewing, testing, and intentionally upgrading them.
  8. Maintain the existing prohibition against placing account secrets, private keys, mnemonics, signatures, and payment headers in prompts or logs.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (13)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill advertises broad activation keywords such as generic location and search terms, which can cause the skill to trigger in unrelated conversations. In an agent environment, over-broad activation increases the chance of unintended external tool use, sending user-provided location or address data to a remote service when the user did not intend that workflow.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
93% confidence
Finding

The skill instructs users to install dependencies via npx skills add ... without pinning a specific package version or commit. This creates a supply-chain risk: a later malicious or compromised package release could be fetched and executed at install time, especially because npx may download code dynamically.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
93% confidence
Finding

This line repeats an unpinned npx skills installation path. Because the command does not constrain the version, anyone following the skill may execute whatever code is current in the upstream package ecosystem at the time of installation, enabling dependency hijack or malicious update scenarios.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
93% confidence
Finding

The skill includes another unversioned npx skills add command in the install script block. Recommending execution of an unpinned remote package increases supply-chain exposure because the executed installer behavior can change over time without review.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
93% confidence
Finding

This is the second unpinned npx skills add command in the script block and has the same supply-chain weakness. Users may assume the documented command is safe and stable, but it can resolve to altered upstream code later, turning documentation into an execution path for compromised packages.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
93% confidence
Finding

The reference section again recommends npx skills add without version pinning. Even in reference text, copy-pasteable install commands are operational instructions, so leaving them unpinned preserves the same risk of executing a malicious or unexpected future release.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
93% confidence
Finding

This unpinned install command is a true supply-chain risk for the same reasons as the other npx skills instances. The danger is amplified by repetition throughout the skill because it normalizes unsafe installation practices across multiple sections.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 377)May include surrounding context.

md
- What AgentPMT is: ../what-is-agentpmt (ClawHub: `what-is-agentpmt`, page: https://clawhub.ai/agentpmt/what-is-agentpmt; skills.sh: `npx skills add AgentPMT/agent-skills --skill what-is-agentpmt`)
- AgentPMT account MCP/REST setup: ../agentpmt-account-mcp-rest-api-setup (ClawHub: `agentpmt-account-mcp-rest-api-setup`, page: https://clawhub.ai/agentpmt/agentpmt-account-mcp-rest-api-setup; skills.sh: `npx skills add AgentPMT/agent-skills --skill agentpmt-account-mcp-rest-api-setup`)
- Marketplace product: https://www.agentpmt.com/marketplace/local-business-discovery-and-mapping
- AgentPMT main MCP server: https://api.agentpmt.com/mcp/
- AgentPMT REST invoke endpoint: https://api.agentpmt.com/products/purchase

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 378)May include surrounding context.

md
- What AgentPMT is: ../what-is-agentpmt (ClawHub: `what-is-agentpmt`, page: https://clawhub.ai/agentpmt/what-is-agentpmt; skills.sh: `npx skills add AgentPMT/agent-skills --skill what-is-agentpmt`)
- AgentPMT account MCP/REST setup: ../agentpmt-account-mcp-rest-api-setup (ClawHub: `agentpmt-account-mcp-rest-api-setup`, page: https://clawhub.ai/agentpmt/agentpmt-account-mcp-rest-api-setup; skills.sh: `npx skills add AgentPMT/agent-skills --skill agentpmt-account-mcp-rest-api-setup`)
- Marketplace product: https://www.agentpmt.com/marketplace/local-business-discovery-and-mapping
- AgentPMT main MCP server: https://api.agentpmt.com/mcp/
- AgentPMT REST invoke endpoint: https://api.agentpmt.com/products/purchase

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
82% confidence
Finding

This markdown schema describes geocoding an address or place name into coordinates, which involves handling sensitive location data. The file provides parameter details but does not include any warning or disclosure about privacy implications of submitting addresses or precise coordinates.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The nearby search action accepts either an address or exact coordinates and automatically geocodes addresses, which can expose a user's location context. The markdown describes the behavior but does not warn users that submitting this data may have privacy implications.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
80% confidence
Finding

Reverse geocoding converts exact latitude and longitude into a human-readable address, which can reveal a precise physical location. The documentation contains no disclosure that this operation processes potentially sensitive location data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
78% confidence
Finding

The text search action allows users to provide an address or coordinates to bias results, which introduces location-sensitive data handling. The description explains functionality but does not disclose the privacy impact of sharing that location context.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.