Security audit

machine-purchase-roi-gate

Security checks for vulnerabilities and agentic risk

Overview

This is a read-only workflow guide for deciding whether a machine-service purchase is economically justified, with a supply-chain caution around unpinned setup commands.

Before installing, prefer the OpenClaw/ClawHub route or pin and verify any skills.sh/npx installer and AgentPMT skill source. Use the skill only as a pre-payment decision gate; do not grant it wallet, signing, payment, or broad filesystem privileges.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:28
Finding: Unpinned Third-Party Package and Skill Installation
Content: View full analysis
Remediation: View remediation
add ... ``` 2. Pin `AgentPMT/agent-skills` to an immutable commit hash or signed release rather than a mutable repository branch or tag. 3. Publish SHA-256 or stronger cryptographic digests for every installed skill and verify them before loading the content. 4. Require signed releases and verify signatures against a documented, trusted maintainer key. 5. Use a lockfile or equivalent dependency manifest that records the exact installer package version, repository commit, and integrity digest. 6. Download dependencies into a staging area and review their manifests, instructions, scripts, and transitive dependencies before installation. 7. Run installation and skill execution in a sandbox with minimum filesystem, credential, network, wallet, and tool permissions. 8. Replace age-based automatic reinstallation with a controlled update process that reviews release provenance and content changes before deployment. 9. Configure package-manager protections to reject lifecycle scripts when they are unnecessary, and use a trusted internal registry or approved artifact mirror where practical. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (10)

Rp1

Medium

Category: MCP Rug Pull
Confidence: 91% confidence
Finding: The skill instructs users to run npx skills add ... without pinning an exact package version or integrity hash. Because npx resolves the latest matching package at execution time, a compromised upstream package, typo-squatted dependency, or malicious update could cause users to install and run unexpected code during setup.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 91% confidence
Finding: This installation instruction uses npx skills without a fixed version, making the executed package dependent on the current registry state. If the package or one of its transitive dependencies is replaced or compromised, users following the skill could execute attacker-controlled code as part of the install flow.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 91% confidence
Finding: The skill references an unpinned npx skills command for setup, which can pull whatever package version is live when the command is run. That creates a supply-chain risk: a malicious or broken release can alter behavior, install unexpected tooling, or execute arbitrary code in the user's environment.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 91% confidence
Finding: This npx skills install step is not version constrained, so the content executed is not stable or auditable over time. An attacker who compromises the package publishing path or dependencies could turn a documentation-following setup step into arbitrary code execution on the client system.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 90% confidence
Finding: The workflow directs use of another tool skill via an unpinned npx skills command, so the fetched installer behavior may change between runs. In practice this increases supply-chain exposure because users are encouraged to execute code from the package registry without an exact version or integrity guarantee.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 90% confidence
Finding: This command invokes npx skills without pinning, so anyone using the documented workflow may execute whichever package version is currently served. A malicious update could silently alter validation behavior, exfiltrate data, or run arbitrary code during installation or invocation.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 90% confidence
Finding: The referenced install command is unpinned and therefore susceptible to upstream package or dependency compromise. Since the skill is intended to guide automation around payment-related decision workflows, compromised setup tooling could tamper with decision logic or the host environment before any safeguards in the workflow itself apply.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 90% confidence
Finding: This setup reference uses floating npx execution, which exposes users to registry-time package substitution or malicious new releases. Even though the skill states it should never access a wallet or pay, a compromised installer could ignore that intent and run arbitrary code locally.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 90% confidence
Finding: The documentation again instructs execution of npx skills without a fixed version, which is a classic supply-chain weakness. Because this skill participates in a workflow involving external tool installation and remote calls, compromised setup code could subvert the supposedly read-only ROI-gating purpose and affect the broader agent environment.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 90% confidence
Finding: This final npx skills reference is also unpinned, so it inherits the same risk of arbitrary upstream changes at execution time. An attacker exploiting the package distribution path could transform a simple setup step into code execution, environment compromise, or workflow manipulation.
Content: No source excerpt is available for this finding.