ClawHub
Back to skill

Security audit

Multi Location Route Optimizer W Map

Security checks for vulnerabilities and agentic risk

Overview

The skill’s route-optimization purpose is coherent, but it should be reviewed because it sends sensitive location data to external services and documents unpinned installation commands for related setup skills.

Install only if you are comfortable sending route locations and related labels to AgentPMT/Google Maps-style services. Avoid submitting unnecessary personal addresses, customer names, or sensitive facility details, and prefer pinned or verified installation methods over the documented unpinned `npx` commands.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:283
Finding

Unpinned Third-Party Installation Executes Mutable Remote Code

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 283-284
Vulnerability Type: Unpinned third-party dependency and remote installation
Risk Level: Medium

Vulnerable Code:

bash
npx skills add AgentPMT/agent-skills --skill what-is-agentpmt
npx skills add AgentPMT/agent-skills --skill agentpmt-account-mcp-rest-api-setup

Technical Analysis

The setup instructions invoke npx without pinning the skills package to a verified version. Depending on the local environment and cache state, npx may retrieve and execute the currently published package from a remote registry. The referenced AgentPMT/agent-skills source is also not pinned to an immutable commit or accompanied by an integrity hash or signature.

Consequently, the code and Skill content executed or installed when a user follows these instructions can differ from what existed when this package was audited. This creates a supply-chain trust boundary involving the npm package, its maintainers, the package registry, the referenced repository, and their dependencies.

No evidence in the reviewed files demonstrates that the currently referenced package or repository is malicious. The vulnerability is the use of mutable, unverified remote dependencies rather than a confirmed malicious payload.

Attack Path

  1. An attacker compromises the npm package, a maintainer account, the referenced repository, or a transitive dependency.
  2. The attacker publishes a modified package version or changes the remotely retrieved Skill content.
  3. A user follows the documented setup procedure and runs the unpinned npx skills add commands.
  4. npx downloads and executes the current package, or the installer retrieves modified repository content.
  5. Attacker-controlled installation logic executes or attacker-controlled Skill instructions are installed under the invoking user's context.

Impact Assessment

Successful exploitation could execute arb ...[truncated 688 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin the skills CLI to an explicitly reviewed version, for example by using an exact package version rather than the latest available release.
  2. Pin AgentPMT/agent-skills to an immutable commit hash or signed release tag instead of a mutable branch or repository default.
  3. Publish and verify cryptographic integrity hashes or signatures for downloaded packages and Skill files.
  4. Configure the installation process to reject unexpected package versions, unsigned artifacts, and integrity mismatches.
  5. Avoid implicit remote execution where possible. Install the reviewed CLI through a locked dependency manifest and invoke the local verified binary.
  6. Review the account setup Skills and their transitive dependencies before installation.
  7. Run installation in a sandbox or minimally privileged environment without unrelated credentials or sensitive environment variables.
  8. Document the trusted registry, expected publisher identity, approved package version, repository commit, and verification procedure directly in SKILL.md.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (12)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill describes transmitting addresses/coordinates to external services and returning Google Maps URLs, but it does not clearly warn users that sensitive location data leaves the local environment and may be exposed via shareable links or signed map URLs. For route-planning workflows, locations can reveal home addresses, customer lists, operational patterns, or other sensitive physical movement data.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The activation keywords include long, generic business phrases that could trigger this skill for ordinary route-planning or scheduling requests outside a user's intent. Over-broad activation increases the chance of accidental invocation of an external service, causing unnecessary data disclosure of addresses, coordinates, and route details.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The skill instructs users to run npx skills ... without pinning an exact package version or commit, which creates a supply-chain risk: a future compromised or breaking package release could be fetched and executed implicitly. In a skill distribution context, install commands are highly trusted, so unpinned execution is materially risky even though no exploit is embedded directly in this file.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

This line repeats an unpinned npx skills installation command, allowing remote code resolution at execution time from the package ecosystem. If the upstream package is hijacked, typo-squatted, or maliciously updated, users may execute attacker-controlled code during setup.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The install instruction on this line uses npx skills without version pinning, creating a remote dependency trust issue. Because users are likely to copy-paste setup commands from skill docs, this increases the chance of silent execution of unexpected code if the package changes.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

This unpinned npx skills reference again exposes consumers to mutable upstream code execution during installation. Repetition across the document broadens exposure because multiple setup paths all depend on the same unversioned trust boundary.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

Like the other occurrences, this command relies on npx fetching the latest matching package state, which is a classic supply-chain weakness. In security review terms, the risk is not theoretical because package compromise can convert documentation into an execution vector.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

This line includes another unpinned npx skills installation example, leaving the setup flow dependent on whatever code is current in the package registry. Since the skill is intended to be used operationally, setup-time compromise could affect agent environments and downstream data handling.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

This is the same supply-chain pattern: an unversioned npx invocation that can download and execute updated code outside the document author's control. The surrounding context of account/tool setup makes this more sensitive because users may run it in environments with credentials configured.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 356)May include surrounding context.

md
- What AgentPMT is: ../what-is-agentpmt (ClawHub: `what-is-agentpmt`, page: https://clawhub.ai/agentpmt/what-is-agentpmt; skills.sh: `npx skills add AgentPMT/agent-skills --skill what-is-agentpmt`)
- AgentPMT account MCP/REST setup: ../agentpmt-account-mcp-rest-api-setup (ClawHub: `agentpmt-account-mcp-rest-api-setup`, page: https://clawhub.ai/agentpmt/agentpmt-account-mcp-rest-api-setup; skills.sh: `npx skills add AgentPMT/agent-skills --skill agentpmt-account-mcp-rest-api-setup`)
- Marketplace product: https://www.agentpmt.com/marketplace/multi-location-route-optimizer-w-map
- AgentPMT main MCP server: https://api.agentpmt.com/mcp/
- AgentPMT REST invoke endpoint: https://api.agentpmt.com/products/purchase

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 357)May include surrounding context.

md
- What AgentPMT is: ../what-is-agentpmt (ClawHub: `what-is-agentpmt`, page: https://clawhub.ai/agentpmt/what-is-agentpmt; skills.sh: `npx skills add AgentPMT/agent-skills --skill what-is-agentpmt`)
- AgentPMT account MCP/REST setup: ../agentpmt-account-mcp-rest-api-setup (ClawHub: `agentpmt-account-mcp-rest-api-setup`, page: https://clawhub.ai/agentpmt/agentpmt-account-mcp-rest-api-setup; skills.sh: `npx skills add AgentPMT/agent-skills --skill agentpmt-account-mcp-rest-api-setup`)
- Marketplace product: https://www.agentpmt.com/marketplace/multi-location-route-optimizer-w-map
- AgentPMT main MCP server: https://api.agentpmt.com/mcp/
- AgentPMT REST invoke endpoint: https://api.agentpmt.com/products/purchase

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The schema explicitly supports sending precise addresses and latitude/longitude coordinates to Google Maps, but it provides no user-facing disclosure, consent prompt, or data-handling warning. Because route optimization inherently involves sensitive location data that may reveal homes, customers, facilities, or operational patterns, silent transmission to a third party creates a meaningful privacy and compliance risk.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.