T08 · Insecure Dependencies
Warning
- Location
SKILL.md:287- Finding
Unpinned Third-Party Skill Installation Creates a Supply-Chain Risk
- Content
View full analysis
- Remediation
View remediation
Security audit
Location Street View Satellite Imagery
Security checks for vulnerabilities and agentic risk
Overview
The skill has a legitimate location-imagery purpose, but it handles precise location data while relying on mutable remote instructions and unpinned setup commands.
Install only if you are comfortable sending addresses or coordinates to AgentPMT and receiving hosted image links retained for 7 days. Prefer the OpenClaw install route or pinned, reviewed versions for supporting skills, and do not let remote live instructions override your agent’s normal safety rules or broaden the task beyond the specific location-imagery request.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T01 · Skill Instruction Hijacking
Warning
- Location
SKILL.md:208- Finding
Mutable Remote Instructions Are Given Precedence Over the Audited Skill
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (12)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill describes functionality but does not prominently warn that addresses/coordinates are transmitted to a remote hosted service and that returned imagery is stored for 7 days. This creates a privacy and consent risk, especially for sensitive locations such as homes, workplaces, or critical sites, because users may not realize data leaves the local agent boundary.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The activation keywords include very generic terms such as
geocodeandaddress, which can cause the skill to be selected for ordinary user requests unrelated to intended, consented remote transmission. Because this skill sends location data to a hosted third-party service and stores imagery for 7 days, over-broad triggering increases the chance of accidental privacy-impacting use.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 94% confidence
- Finding
The skill instructs users to install supporting skills via
npx skills ...without pinning a specific package version or immutable source revision. This creates a supply-chain risk: a later compromised or malicious package update could be fetched and executed in the user's environment when they follow the installation instructions.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 94% confidence
- Finding
This line references an unpinned
npx skillsinstallation command for a related setup skill. Becausenpxresolves packages dynamically, users may execute unintended or newly published code if the upstream package changes or is hijacked.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 94% confidence
- Finding
The skill includes another
npx skillsinstall path without version pinning, expanding the attack surface for supply-chain compromise. Even though this is documentation rather than executable code in the skill itself, it can still induce risky operator behavior.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 94% confidence
- Finding
The referenced install instruction uses
npx skillswithout a pinned version for thewhat-is-agentpmtskill. This permits execution of whatever current package version is served at install time, which is a classic supply-chain integrity weakness.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 94% confidence
- Finding
This adjacent install instruction also uses an unpinned
npx skillscommand foragentpmt-account-mcp-rest-api-setup. A compromised package publisher, registry entry, or dependency update could lead users to execute malicious code during setup.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 94% confidence
- Finding
The reference section repeats an unpinned
npx skillscommand. Repetition increases the likelihood users will copy and run a mutable installer command, preserving the same supply-chain execution risk.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 94% confidence
- Finding
This is another unpinned
npx skillsinstallation example in the reference section, carrying the same risk of dynamic code execution from a mutable upstream source. In security-sensitive agent environments, setup instructions are part of the trusted attack surface.- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md - What AgentPMT is: ../what-is-agentpmt (ClawHub: `what-is-agentpmt`, page: https://clawhub.ai/agentpmt/what-is-agentpmt; skills.sh: `npx skills add AgentPMT/agent-skills --skill what-is-agentpmt`) - AgentPMT account MCP/REST setup: ../agentpmt-account-mcp-rest-api-setup (ClawHub: `agentpmt-account-mcp-rest-api-setup`, page: https://clawhub.ai/agentpmt/agentpmt-account-mcp-rest-api-setup; skills.sh: `npx skills add AgentPMT/agent-skills --skill agentpmt-account-mcp-rest-api-setup`) - Marketplace product: https://www.agentpmt.com/marketplace/location-street-view-satellite-imagery - AgentPMT main MCP server: https://api.agentpmt.com/mcp/ - AgentPMT REST invoke endpoint: https://api.agentpmt.com/products/purchase
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md - What AgentPMT is: ../what-is-agentpmt (ClawHub: `what-is-agentpmt`, page: https://clawhub.ai/agentpmt/what-is-agentpmt; skills.sh: `npx skills add AgentPMT/agent-skills --skill what-is-agentpmt`) - AgentPMT account MCP/REST setup: ../agentpmt-account-mcp-rest-api-setup (ClawHub: `agentpmt-account-mcp-rest-api-setup`, page: https://clawhub.ai/agentpmt/agentpmt-account-mcp-rest-api-setup; skills.sh: `npx skills add AgentPMT/agent-skills --skill agentpmt-account-mcp-rest-api-setup`) - Marketplace product: https://www.agentpmt.com/marketplace/location-street-view-satellite-imagery - AgentPMT main MCP server: https://api.agentpmt.com/mcp/ - AgentPMT REST invoke endpoint: https://api.agentpmt.com/products/purchase
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The schema documents geocoding, reverse geocoding, satellite imagery, and Street View retrieval using precise addresses and coordinates, but it provides no privacy or sensitive-location handling guidance. Because these inputs can reveal home addresses, travel patterns, or exact property locations, an agent could collect, transmit, or retain highly sensitive location data without appropriate safeguards.
- Content
Static analysis
No suspicious patterns detected.