ClawHub
Back to skill

Security audit

plaud-spoken-field-notes-to-a-structured-sheet

Security checks for vulnerabilities and agentic risk

Overview

The workflow does what it says, but its setup repeatedly tells users to run unpinned remote installers for tools that can access recordings and spreadsheets.

Before installing, prefer pinned or ClawHub-reviewed install paths where available, verify the AgentPMT, Plaud, and Google Sheets tool permissions, and use this only with recordings and spreadsheets you are allowed to process through those services.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:33
Finding

Unpinned Third-Party Package and Skill Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 33–44
Vulnerability Type: Unpinned third-party dependency execution
Risk Level: Medium

Vulnerable Code

markdown
Core AgentPMT setup skills:
- What AgentPMT is: ../what-is-agentpmt
  - ClawHub page: https://clawhub.ai/agentpmt/what-is-agentpmt
  - OpenClaw install: `openclaw skills install what-is-agentpmt`
  - skills.sh install: `npx skills add AgentPMT/agent-skills --skill what-is-agentpmt`
- AgentPMT account MCP/REST setup: ../agentpmt-account-mcp-rest-api-setup
  - ClawHub page: https://clawhub.ai/agentpmt/agentpmt-account-mcp-rest-api-setup
  - OpenClaw install: `openclaw skills install agentpmt-account-mcp-rest-api-setup`
  - skills.sh install: `npx skills add AgentPMT/agent-skills --skill agentpmt-account-mcp-rest-api-setup`

skills.sh install script:

```bash
npx skills add AgentPMT/agent-skills --skill what-is-agentpmt
npx skills add AgentPMT/agent-skills --skill agentpmt-account-mcp-rest-api-setup
text

The same unpinned installation pattern is repeated for the timezone, Plaud, and Google Sheets skills at lines 54–55, 65–66, 76–77, and 88–95.

### Technical Analysis

The documented commands invoke `npx skills` without specifying an exact version of the npm package. The `AgentPMT/agent-skills` source is likewise not pinned to an immutable commit, verified release, or integrity digest. Thus, the code and instructions installed when a user executes these commands may differ from what existed when this skill was audited.

This creates a supply-chain risk: compromise of the package, its publishing account, the referenced repository, or its distribution infrastructure could cause future installations to retrieve altered components. The skill's freshness instruction also encourages reinstallation after seven days, increasing exposure to post-review dependency changes.

No evidence establishes that the dependencies are currently malicious. The issue is the absence of immutable ve
...[truncated 1365 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin the skills npm package to a reviewed exact version, for example by using an exact package version rather than allowing npx to resolve the latest release.
  2. Pin AgentPMT/agent-skills to an immutable commit hash or cryptographically verified release tag.
  3. Publish and verify integrity hashes or signed provenance for downloaded packages and skill artifacts.
  4. Use a lockfile or equivalent reproducible dependency manifest where the installation mechanism supports it.
  5. Avoid automatic or freshness-driven upgrades without reviewing the new package contents and release provenance.
  6. Run installers with the minimum necessary operating-system privileges and isolate installation in a restricted environment.
  7. Grant installed Plaud, AgentPMT, and Google Sheets integrations only the scopes required by this workflow.
  8. Apply the same controls to every repeated unpinned installation command at lines 54–55, 65–66, 76–77, and 88–95.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (14)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The workflow description explains that recordings are read, transcripts are pulled, fields are extracted, and rows are appended to Google Sheets, but it does not explicitly warn users that spoken recordings/transcripts and extracted data are transmitted to third-party services. For a workflow processing potentially sensitive site notes, client details, measurements, inspection findings, or service information, the missing privacy disclosure increases the risk of uninformed data exposure and noncompliant handling.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
91% confidence
Finding

The skill instructs users to run npx skills ... without pinning an exact package version, which can pull whatever version is current at execution time. This creates a supply-chain risk: a compromised, typosquatted, or breaking upstream release could execute unexpected code or install altered skill content in the user's environment.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
91% confidence
Finding

This unpinned npx skills invocation leaves the installed tooling and fetched content dependent on the latest upstream state rather than a reviewed version. If the package or referenced skill repository is modified maliciously or unexpectedly, users may execute untrusted code or receive altered workflow instructions.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
93% confidence
Finding

The install script uses npx skills without an explicit version pin, so the command may resolve to different code over time. Because npx can download and execute packages on demand, this increases exposure to supply-chain compromise and non-reproducible installs.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
93% confidence
Finding

This second install-script invocation repeats the same unpinned npx skills pattern, compounding supply-chain and reproducibility risk. A future or malicious package update could change install behavior or execute attacker-controlled code during setup.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
88% confidence
Finding

Although presented as a dependency/setup instruction, this npx skills command still causes users to fetch and execute unpinned remote code. In a security-sensitive workflow ecosystem, that makes the skill chain only as trustworthy as the latest package publication and referenced upstream assets.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
88% confidence
Finding

The Plaud tool dependency is referenced via an unpinned npx skills install command, which can change behavior between runs and opens the door to supply-chain abuse. Because this workflow handles external service data and account-linked tools, compromised setup steps could have broader downstream access.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
88% confidence
Finding

This unversioned npx skills instruction for the Plaud tool repeats the same issue: it relies on mutable upstream state and may execute newly published code without prior review. Since the tool processes recordings and transcripts, a compromised install path could expose sensitive data or alter extraction behavior.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
88% confidence
Finding

The Google Sheets dependency is installed through an unpinned npx skills command, introducing supply-chain and reproducibility risk. If a malicious or faulty upstream version is served, it could gain access to spreadsheet data or modify workflow behavior during setup or execution.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
86% confidence
Finding

The tool link section includes another floating npx skills command, again depending on whatever package version is current. While informational, it still directs users toward executing mutable third-party code, which is a valid supply-chain concern.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
86% confidence
Finding

This repeated unpinned installer command inherits the same supply-chain risk as the others. Attackers often exploit exactly this pattern by compromising package publication or dependency resolution, especially where users expect setup commands to be safe boilerplate.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
86% confidence
Finding

The Google Sheets tool link also uses an unpinned npx skills command, so future installs are not tied to the reviewed state of this skill. In workflows that can read/write user spreadsheets, setup integrity matters because compromised tooling could exfiltrate or tamper with business data.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
85% confidence
Finding

This AgentPMT reference section again instructs users to install a dependency through an unpinned npx package execution. Even though it is ancillary documentation, it still normalizes unsafe installation practice and can lead to execution of altered remote code.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
85% confidence
Finding

The final reference line repeats the same unpinned npx skills pattern, preserving supply-chain risk in another location. The cumulative effect is that the document consistently guides users toward mutable, non-reproducible installs across the workflow's dependency chain.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.