ClawHub
Back to skill

Security audit

Quantum Safe File Attestation

Security checks for vulnerabilities and agentic risk

Overview

The skill matches its stated remote file-attestation purpose, but its unpinned install commands and remote file-storage workflow deserve user review before use.

Review before installing. Use this only for files your policy allows you to upload to AgentPMT file storage, avoid putting secrets in metadata, and do not run the npx install snippets in a sensitive environment unless you have pinned and verified the package/source versions.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:190
Finding

Unpinned Third-Party Skill Installation Creates Supply-Chain Risk

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:14, SKILL.md:190-206
Vulnerability Type: Unpinned and mutable third-party dependencies
Risk Level: Medium

Vulnerable Code

markdown
If the current date is more than 7 days after the last updated date, reinstall this skill from skills.sh or ClawHub before relying on endpoints, schemas, setup steps, or examples.
markdown
Core AgentPMT setup skills:
- What AgentPMT is: ../what-is-agentpmt
  - ClawHub page: https://clawhub.ai/agentpmt/what-is-agentpmt
  - OpenClaw install: `openclaw skills install what-is-agentpmt`
  - skills.sh install: `npx skills add AgentPMT/agent-skills --skill what-is-agentpmt`
- AgentPMT account MCP/REST setup: ../agentpmt-account-mcp-rest-api-setup
  - ClawHub page: https://clawhub.ai/agentpmt/agentpmt-account-mcp-rest-api-setup
  - OpenClaw install: `openclaw skills install agentpmt-account-mcp-rest-api-setup`
  - skills.sh install: `npx skills add AgentPMT/agent-skills --skill agentpmt-account-mcp-rest-api-setup`

skills.sh install script:

```bash
npx skills add AgentPMT/agent-skills --skill what-is-agentpmt
npx skills add AgentPMT/agent-skills --skill agentpmt-account-mcp-rest-api-setup
text

### Technical Analysis

The Skill directs users or agents to invoke `npx` and install remotely hosted Skills without pinning the `skills` package version, the `AgentPMT/agent-skills` repository to an immutable commit, or the downloaded content to a verified checksum or signature. The seven-day freshness instruction also encourages repeated retrieval of mutable remote content.

Consequently, the effective setup instructions and any associated executable components may change after this Skill has been audited. Compromise of the npm package, source repository, publishing account, marketplace distribution channel, or an upstream dependency could cause later installations to retrieve attacker-controlled content.

This 
...[truncated 1833 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin the skills npm package to a reviewed, exact version rather than allowing npx to resolve the latest release.
  2. Pin AgentPMT/agent-skills to an immutable commit hash or signed release tag.
  3. Publish cryptographic checksums or signed provenance for every downloaded Skill and verify them before installation.
  4. Avoid unconditional reinstall instructions based solely on elapsed time. Instead, notify the user that an update exists and require explicit approval after displaying the source and version change.
  5. Use a locked dependency manifest and integrity metadata where supported.
  6. Run installation in a restricted environment without access to unrelated credentials, sensitive files, or privileged system locations.
  7. Document the exact trusted domains, package owners, expected repository, and verification procedure.
  8. Before uploading an artifact for remote attestation, obtain explicit user consent and disclose the service endpoint, data-retention policy, and fact that the complete artifact will leave the local environment.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (12)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The skill processes user-provided files via a remote AgentPMT-hosted service but does not clearly warn users in the description that uploaded artifacts and attestation packages are transmitted to external infrastructure. This can lead to unintended disclosure of proprietary, regulated, or sensitive files because users may assume a local or offline cryptographic workflow from the description's emphasis on independent verification and formal guarantees.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The listed search and activation keywords include the standalone term "attest," which is broad and can overlap with common requests outside this specific product. The file does not provide exclusion conditions or negative examples to constrain when that keyword should or should not activate the skill.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The skill instructs users to run npx skills without pinning an exact package version or immutable source reference. This creates a supply-chain risk: a compromised or newly published package version could be fetched and executed at install time, leading to arbitrary code execution on the user's machine or in the agent environment.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

This line references npx skills as an installation path without any version pinning. Unpinned package execution allows upstream package changes or account compromise to alter what is executed, which is especially risky in agent/tooling setup flows that users may trust and copy verbatim.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The skill includes another unpinned npx skills command. Because npx may resolve and execute the latest available package, an attacker who compromises the package or dependency chain could deliver malicious code during installation.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

This install instruction again relies on npx skills without a fixed version. Repeated unpinned references normalize unsafe installation behavior and increase the chance that operators execute unreviewed remote code.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The second command in the multi-line install script is also unpinned. Multi-command bootstrap snippets are particularly dangerous because users often run them wholesale, giving an attacker a straightforward path to code execution if the package source is compromised.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

This reference to npx skills remains unpinned in the AgentPMT reference section. Even informational references can be copied into production environments, exposing users to remote package substitution and supply-chain compromise.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

Like the adjacent reference, this unpinned npx skills command introduces supply-chain exposure through dynamic package resolution. In a security-focused attestation skill, such installation guidance undermines the trust model by requiring trust in mutable external code.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 260)May include surrounding context.

md
- What AgentPMT is: ../what-is-agentpmt (ClawHub: `what-is-agentpmt`, page: https://clawhub.ai/agentpmt/what-is-agentpmt; skills.sh: `npx skills add AgentPMT/agent-skills --skill what-is-agentpmt`)
- AgentPMT account MCP/REST setup: ../agentpmt-account-mcp-rest-api-setup (ClawHub: `agentpmt-account-mcp-rest-api-setup`, page: https://clawhub.ai/agentpmt/agentpmt-account-mcp-rest-api-setup; skills.sh: `npx skills add AgentPMT/agent-skills --skill agentpmt-account-mcp-rest-api-setup`)
- Marketplace product: https://www.agentpmt.com/marketplace/quantum-safe-file-attestation
- AgentPMT main MCP server: https://api.agentpmt.com/mcp/
- AgentPMT REST invoke endpoint: https://api.agentpmt.com/products/purchase

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 261)May include surrounding context.

md
- What AgentPMT is: ../what-is-agentpmt (ClawHub: `what-is-agentpmt`, page: https://clawhub.ai/agentpmt/what-is-agentpmt; skills.sh: `npx skills add AgentPMT/agent-skills --skill what-is-agentpmt`)
- AgentPMT account MCP/REST setup: ../agentpmt-account-mcp-rest-api-setup (ClawHub: `agentpmt-account-mcp-rest-api-setup`, page: https://clawhub.ai/agentpmt/agentpmt-account-mcp-rest-api-setup; skills.sh: `npx skills add AgentPMT/agent-skills --skill agentpmt-account-mcp-rest-api-setup`)
- Marketplace product: https://www.agentpmt.com/marketplace/quantum-safe-file-attestation
- AgentPMT main MCP server: https://api.agentpmt.com/mcp/
- AgentPMT REST invoke endpoint: https://api.agentpmt.com/products/purchase

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
89% confidence
Finding

This markdown file states that attest_artifact saves an attestation package to file storage and returns its file ID, which is a user-data-affecting write operation. The description presents the behavior functionally but does not include any warning or explicit disclosure about creating a new stored artifact or its storage impact.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.