product-mockup-studio

• Outcome: Review
• Latest audit: Sep 16, 2026 · 1:44 AM UTC
• Version: 1.0.0

Overview

This looks like a legitimate AgentPMT product mockup skill, but it relies on mutable remote instructions and unpinned install commands that users should review before use.

Install only from a trusted source, prefer pinned or ClawHub/OpenClaw installation routes over unpinned `npx`, and review any live schema or instruction response before letting it change behavior or trigger paid generation. Expect product photos and prompts to be processed by AgentPMT and its providers, and avoid sending secrets, private keys, payment headers, or unnecessary sensitive product material.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:192
• Finding: Unpinned Third-Party Skill Installation Creates a Supply-Chain Risk## Vulnerability Details **File Location**: `SKILL.md:106`, `SKILL.md:192-202`, and `SKILL.md:263-264` **Vulnerability Type**: Unpinned and mutable third-party dependencies **Risk Level**: Medium The Skill recommends installing additional components from a remote repository using `npx`, without pinning the package version, repository commit, or integrity digest. ```markdown - File Management: ../file-management (ClawHub: `file-management`, page: https://clawhub.ai/agentpmt/file-management; skills.sh: `npx skills add AgentPMT/agent-skills --skill file-management`) ``` ```markdown Core AgentPMT setup skills: - What AgentPMT is: ../what-is-agentpmt - ClawHub page: https://clawhub.ai/agentpmt/what-is-agentpmt - OpenClaw install: `openclaw skills install what-is-agentpmt` - skills.sh install: `npx skills add AgentPMT/agent-skills --skill what-is-agentpmt` - AgentPMT account MCP/REST setup: ../agentpmt-account-mcp-rest-api-setup - ClawHub page: https://clawhub.ai/agentpmt/agentpmt-account-mcp-rest-api-setup - OpenClaw install: `openclaw skills install agentpmt-account-mcp-rest-api-setup` - skills.sh install: `npx skills add AgentPMT/agent-skills --skill agentpmt-account-mcp-rest-api-setup` skills.sh install script: ```bash npx skills add AgentPMT/agent-skills --skill what-is-agentpmt npx skills add AgentPMT/agent-skills --skill agentpmt-account-mcp-rest-api-setup ``` ``` ### Technical Analysis The `npx skills add` commands resolve and execute remotely distributed tooling and retrieve content from the mutable `AgentPMT/agent-skills` source. Neither an immutable repository commit nor a cryptographic integrity value is specified. Consequently, the effective dependency content installed by a user can differ from the content that existed when this Skill was audited. This is particularly sensitive for the account MCP/REST setup Skill because that component is expected to provide instructions related to ...[truncated 1594 chars]
• Remediation: ## Remediation Suggestions 1. Pin every installed dependency to an immutable package version and repository commit. 2. Publish and verify cryptographic integrity hashes or signed release artifacts before installation. 3. Avoid commands that implicitly resolve the latest version of an executable package. 4. Use a verified package registry and enable provenance or signature verification where supported. 5. Vendor security-critical setup instructions into the audited Skill when practical. 6. Require users to inspect downloaded Skill content before activation, particularly content that handles authentication or account setup. 7. Run installation in a restricted environment without access to production credentials, sensitive files, or privileged system paths. 8. Document the exact expected dependency versions and establish a controlled update and re-audit process.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:123
• Finding: Remote Mutable Instructions Are Given Precedence Over Audited Local Instructions## Vulnerability Details **File Location**: `SKILL.md:123-127` **Vulnerability Type**: Unsafe trust of remotely supplied instructions **Risk Level**: Medium The Skill instructs the agent to retrieve live instructions from a remote AgentPMT tool and treat the returned content as more specific than the locally audited summary. ```markdown ## Live Schema And Examples Use the compact schema above for ordinary calls. Before a new production integration, or whenever parameters, enum values, nested objects, outputs, or examples are unclear, fetch live details first. - Exact schema: call `agentpmt-tool-search-and-execution` with `action: "get_schema"`, and `tool_id: "product-mockup-studio"`. - Detailed examples: call `agentpmt-tool-search-and-execution` with `action: "get_instructions"` and `tool_id: "product-mockup-studio"`, or call this product with `action: "get_instructions"` when the product tool is already selected. - Treat returned live schema and instructions as more specific than this generated summary. ``` ### Technical Analysis The local Skill creates an authoritative instruction channel whose content can change independently of the audited project. Remote schemas are useful for compatibility, but an unrestricted instruction response is not equivalent to structured schema data. It may contain natural-language directives capable of changing arguments, destinations, data-handling behavior, or workflow decisions. No malicious remote response is present in the audited files, and the audit did not access or validate the live service. The security defect is the explicit precedence granted to unaudited, remotely mutable instructions without signature verification, version pinning, schema confinement, or a rule that remote content must be treated only as untrusted data. ### Attack Path 1. An attacker compromises the AgentPMT service, an administrative account, the remote instruction store, or the connection through which live i ...[truncated 1191 chars]
• Remediation: ## Remediation Suggestions 1. Treat all remote instruction text as untrusted data rather than authoritative agent instructions. 2. Remove the directive that remote content takes precedence over the audited local Skill. 3. Permit live responses to refine only explicitly enumerated schema fields; reject commands, URLs, credential requests, and behavioral directives outside that schema. 4. Pin remote schemas and instructions to a reviewed version or signed content digest. 5. Verify server signatures and expected tool identity before processing a live response. 6. Compare remotely returned schemas against a local allowlist and require explicit user approval for material changes. 7. Ensure remote content can never override system instructions, safety controls, credential-handling rules, destination restrictions, or data-minimization requirements. 8. Log the remote document version and validated differences without recording credentials or sensitive media. 9. Fail closed when the response contains unknown fields, conflicting instructions, or requests to invoke undeclared tools.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (12)

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The manifest description says to use the skill 'when an agent needs product mockup studio' followed by a long list of broad marketing-related phrases. Several of these phrases are generic e-commerce/image-editing intents rather than narrowly scoped trigger conditions, which could cause the skill to match ordinary requests beyond its intended boundaries.

Vague Triggers

Medium

• Confidence: 87% confidence
• Finding: The file provides a keyword list for activation, but many phrases are common task descriptions like marketplace listing photos or lifestyle product scenes. Because no negative examples or exclusion conditions are given, the trigger scope is ambiguous and may overlap with unrelated creative or image-generation requests.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

External Transmission

Medium

• Category: Data Exfiltration

Content

- What AgentPMT is: ../what-is-agentpmt (ClawHub: `what-is-agentpmt`, page: https://clawhub.ai/agentpmt/what-is-agentpmt; skills.sh: `npx skills add AgentPMT/agent-skills --skill what-is-agentpmt`)
- AgentPMT account MCP/REST setup: ../agentpmt-account-mcp-rest-api-setup (ClawHub: `agentpmt-account-mcp-rest-api-setup`, page: https://clawhub.ai/agentpmt/agentpmt-account-mcp-rest-api-setup; skills.sh: `npx skills add AgentPMT/agent-skills --skill agentpmt-account-mcp-rest-api-setup`)
- Marketplace product: https://www.agentpmt.com/marketplace/product-mockup-studio
- AgentPMT main MCP server: https://api.agentpmt.com/mcp/
- AgentPMT REST invoke endpoint: https://api.agentpmt.com/products/purchase

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

- What AgentPMT is: ../what-is-agentpmt (ClawHub: `what-is-agentpmt`, page: https://clawhub.ai/agentpmt/what-is-agentpmt; skills.sh: `npx skills add AgentPMT/agent-skills --skill what-is-agentpmt`)
- AgentPMT account MCP/REST setup: ../agentpmt-account-mcp-rest-api-setup (ClawHub: `agentpmt-account-mcp-rest-api-setup`, page: https://clawhub.ai/agentpmt/agentpmt-account-mcp-rest-api-setup; skills.sh: `npx skills add AgentPMT/agent-skills --skill agentpmt-account-mcp-rest-api-setup`)
- Marketplace product: https://www.agentpmt.com/marketplace/product-mockup-studio
- AgentPMT main MCP server: https://api.agentpmt.com/mcp/
- AgentPMT REST invoke endpoint: https://api.agentpmt.com/products/purchase

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Low

• Confidence: 93% confidence
• Finding: This markdown description states that checking a mockup job will 'import a completed PNG or MP4 into File Manager,' which affects user data/storage state. The file does not provide any explicit warning or disclosure about this side effect beyond the brief action summary, so users may not realize the action writes new assets into their workspace.

Static analysis

No suspicious patterns detected.