ClawHub
Back to skill

Security audit

machine-payment-endpoint-preflight

Security checks for vulnerabilities and agentic risk

Overview

The skill is a narrowly scoped endpoint preflight checker that avoids credentials and payments, with the main caveat being mutable unpinned setup commands.

Before installing, prefer OpenClaw or another trusted installer path with pinned versions where available, review the linked AgentPMT helper skills, and do not provide private URLs, credentials, cookies, wallet keys, or payment approval while using this workflow.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:24
Finding

Unpinned Third-Party Skill Installation Creates a Supply-Chain Risk

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 24–37, 53–54, 62–63, and 70–71
Vulnerability Type: Unpinned third-party dependencies
Risk Level: Medium

Vulnerable Code Snippets

SKILL.md, lines 24–37:

markdown
Core AgentPMT setup skills:
- What AgentPMT is: ../what-is-agentpmt
  - ClawHub page: https://clawhub.ai/agentpmt/what-is-agentpmt
  - OpenClaw install: `openclaw skills install what-is-agentpmt`
  - skills.sh install: `npx skills add AgentPMT/agent-skills --skill what-is-agentpmt`
- AgentPMT account MCP/REST setup: ../agentpmt-account-mcp-rest-api-setup
  - ClawHub page: https://clawhub.ai/agentpmt/agentpmt-account-mcp-rest-api-setup
  - OpenClaw install: `openclaw skills install agentpmt-account-mcp-rest-api-setup`
  - skills.sh install: `npx skills add AgentPMT/agent-skills --skill agentpmt-account-mcp-rest-api-setup`

skills.sh install script:

```bash
npx skills add AgentPMT/agent-skills --skill what-is-agentpmt
npx skills add AgentPMT/agent-skills --skill agentpmt-account-mcp-rest-api-setup
text

`SKILL.md`, lines 53–54:

```markdown
- Tool skill: `../data-format-validation`.
- ClawHub page: https://clawhub.ai/agentpmt/data-format-validation.

SKILL.md, lines 62–63:

markdown
- Tool skill: `../webhook-http-request`.
- ClawHub page: https://clawhub.ai/agentpmt/webhook-http-request.

SKILL.md, lines 70–71:

markdown
- Data Format Validation: `../data-format-validation`; ClawHub https://clawhub.ai/agentpmt/data-format-validation; skills.sh `npx skills add AgentPMT/agent-skills --skill data-format-validation`; marketplace https://www.agentpmt.com/marketplace/data-format-validation
- Webhook - HTTP Request: `../webhook-http-request`; ClawHub https://clawhub.ai/agentpmt/webhook-http-request; skills.sh `npx skills add AgentPMT/agent-skills --skill webhook-http-request`; marketplace https://www.agentpmt.com/marketplace/webhook-http-request

Technical Analysis

The Skill directs users to invoke `n ...[truncated 2666 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin the skills npm package to an exact reviewed version rather than relying on the version selected implicitly by npx.
  2. Pin each external Skill to an immutable commit hash, signed release, or exact version.
  3. Publish and verify cryptographic checksums or signatures before installation.
  4. Avoid mutable installation commands in security-sensitive workflow documentation.
  5. Vendor the security-critical schemas and instructions needed for URL validation and bounded HTTP requests into the reviewed project where licensing permits.
  6. Lock transitive dependencies and perform reproducible installation from an approved registry.
  7. Require explicit review and approval before freshness-driven updates or reinstalls.
  8. Run installation and imported Skills in a sandbox with minimal filesystem, environment, credential, and network access.
  9. Maintain an allowlist for outbound destinations and independently enforce the documented one-request, 128 KiB, and 15-second limits outside the imported Skill.
  10. Record resolved versions and integrity values in audit logs so the exact installed artifacts can be traced.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (10)

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The skill instructs users to run npx skills without pinning an exact package version or immutable source, which allows whatever version is current at execution time to be fetched and run. If the upstream package, dependency chain, or publication account is compromised, this workflow could lead to execution of unexpected code during installation.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

This installation instruction uses npx skills with no version pinning, so the actual code executed depends on the latest published package state at runtime. That creates supply-chain risk and weakens reproducibility for anyone following the skill setup steps.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The script snippet includes an unpinned npx skills command, which can resolve to different package contents over time and may execute attacker-controlled updates if the package ecosystem is compromised. Because this is presented as copy-paste setup text, it materially increases the chance of unsafe execution.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

This second copy-paste installation line also relies on npx skills without version pinning, exposing users to the same supply-chain and reproducibility issues. Repeated unpinned commands amplify the risk by normalizing insecure installation practice across linked skills.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
94% confidence
Finding

The linked tool skill installation command uses an unpinned npx skills invocation, allowing mutable upstream package resolution. Since this workflow depends on linked tools, compromise of the installer path could affect not just this skill but the broader toolchain it directs users to add.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
94% confidence
Finding

This command installs another linked tool through an unpinned npx skills call, which means users may execute a different package revision than the author intended. For a workflow that orchestrates network requests, trusting mutable installer code increases the attack surface before the workflow even runs.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
94% confidence
Finding

The tool skill link section repeats an unpinned installer command, preserving the same supply-chain weakness in another user-facing location. Multiple duplicated insecure install references make accidental unsafe adoption more likely.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
94% confidence
Finding

This linked tool installation instruction also leaves package resolution open-ended via npx skills, enabling silent drift or malicious substitution if the package source is tampered with. The risk is especially relevant because the workflow explicitly asks users to install and trust external helper skills.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
94% confidence
Finding

The AgentPMT reference section includes another unpinned npx skills command, continuing the pattern of mutable installer execution. Even though this is reference material, users commonly copy commands from such sections directly, so the exposure is still practical.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
94% confidence
Finding

This final installation example again uses npx skills without a pinned version, creating a recurring supply-chain risk across the skill documentation. The issue appears negligent rather than malicious, but it still exposes operators to arbitrary code execution through package substitution or compromise.

Content

No source excerpt is available for this finding.