ClawHub
Back to skill

Security audit

Real Estate Aerial Video Generator

Security checks for vulnerabilities and agentic risk

Overview

The skill’s core purpose is coherent, but its setup and live-instruction guidance rely on mutable remote content and unpinned installers that users should review carefully.

Install only if you are comfortable sending property addresses to AgentPMT and using its authenticated MCP or REST service. Prefer pinned or reviewed installation sources for the related setup skills, avoid running unpinned npx commands in sensitive environments, and do not let live remote instructions override your local security rules or credential-handling limits.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:14
Finding

Unpinned Third-Party Installation and Mutable Remote Instructions

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:14, SKILL.md:149-151, SKILL.md:214-226
Vulnerability Type: Unpinned dependency installation and reliance on mutable remote instructions
Risk Level: Medium

Vulnerable Code Snippets

SKILL.md:14:

text
If the current date is more than 7 days after the last updated date, reinstall this skill from skills.sh or ClawHub before relying on endpoints, schemas, setup steps, or examples.

SKILL.md:149-151:

text
- Exact schema: call `agentpmt-tool-search-and-execution` with `action: "get_schema"`, and `tool_id: "real-estate-aerial-video-generator"`.
- Detailed examples: call `agentpmt-tool-search-and-execution` with `action: "get_instructions"` and `tool_id: "real-estate-aerial-video-generator"`, or call this product with `action: "get_instructions"` when the product tool is already selected.
- Treat returned live schema and instructions as more specific than this generated summary.

SKILL.md:214-226:

text
Core AgentPMT setup skills:
- What AgentPMT is: ../what-is-agentpmt
  - ClawHub page: https://clawhub.ai/agentpmt/what-is-agentpmt
  - OpenClaw install: `openclaw skills install what-is-agentpmt`
  - skills.sh install: `npx skills add AgentPMT/agent-skills --skill what-is-agentpmt`
- AgentPMT account MCP/REST setup: ../agentpmt-account-mcp-rest-api-setup
  - ClawHub page: https://clawhub.ai/agentpmt/agentpmt-account-mcp-rest-api-setup
  - OpenClaw install: `openclaw skills install agentpmt-account-mcp-rest-api-setup`
  - skills.sh install: `npx skills add AgentPMT/agent-skills --skill agentpmt-account-mcp-rest-api-setup`

skills.sh install script:

```bash
npx skills add AgentPMT/agent-skills --skill what-is-agentpmt
npx skills add AgentPMT/agent-skills --skill agentpmt-account-mcp-rest-api-setup
text

### Technical Analysis

The skill instructs an agent or operator to install content from third-party distrib
...[truncated 2462 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin every installed skill to an immutable release version or reviewed commit hash rather than installing from a moving repository reference.
  2. Publish and verify cryptographic checksums or signed provenance for downloaded skill packages before installation.
  3. Replace automatic reinstallation guidance with a controlled update process that requires reviewing release notes, permissions, and content changes.
  4. Do not allow remotely returned instructions to override local security policies, credential-handling restrictions, user-consent requirements, or least-privilege constraints.
  5. Validate remote schemas and instructions against a locally defined allowlist of supported actions and parameters.
  6. Run package installation and skill execution in a restricted environment with minimal filesystem, process, credential, and network access.
  7. Separate package acquisition from execution so downloaded content can be statically reviewed before being loaded.
  8. Record and display the exact package version, source commit, digest, and remote schema version used for each production invocation.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (10)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill encourages users to submit full street addresses but does not clearly disclose that this data is sent to a remote AgentPMT service. Street addresses are sensitive location data, so the omission undermines informed consent and can cause unintended external disclosure of private property or user location information.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
91% confidence
Finding

The skill includes npx skills ... installation commands without pinning an exact package version or immutable source. This creates a supply-chain risk because a future package update or compromise could cause users to install and execute unintended code when following the documented setup steps.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
91% confidence
Finding

This line references an unpinned npx skills install command, which can resolve to whatever package version is current at execution time. If the upstream package is maliciously updated or compromised, users may execute attacker-controlled code during installation.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
91% confidence
Finding

The skill documentation again instructs users to run an unpinned npx skills command, introducing a supply-chain trust problem. Because npx fetches and executes package content dynamically, lack of version pinning increases exposure to malicious or breaking upstream changes.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
91% confidence
Finding

This unpinned npx skills example leaves the executed installer version uncontrolled. An attacker who compromises the package or publishing account could cause arbitrary code execution on user systems that follow the installation guidance.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
91% confidence
Finding

Like the surrounding lines, this command depends on an unpinned remote package execution path via npx. That is dangerous because it turns documentation into a supply-chain execution vector if the referenced package changes or is hijacked.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
91% confidence
Finding

The reference contains another floating npx skills install command with no version constraint. This can expose users to unintended code execution through compromised or altered upstream packages when following the skill's setup instructions.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
91% confidence
Finding

This documentation line repeats the same unpinned npx execution pattern, preserving the same supply-chain risk. The issue is amplified because multiple copies of the command increase the chance users will follow one of them without additional scrutiny.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 278)May include surrounding context.

md
- What AgentPMT is: ../what-is-agentpmt (ClawHub: `what-is-agentpmt`, page: https://clawhub.ai/agentpmt/what-is-agentpmt; skills.sh: `npx skills add AgentPMT/agent-skills --skill what-is-agentpmt`)
- AgentPMT account MCP/REST setup: ../agentpmt-account-mcp-rest-api-setup (ClawHub: `agentpmt-account-mcp-rest-api-setup`, page: https://clawhub.ai/agentpmt/agentpmt-account-mcp-rest-api-setup; skills.sh: `npx skills add AgentPMT/agent-skills --skill agentpmt-account-mcp-rest-api-setup`)
- Marketplace product: https://www.agentpmt.com/marketplace/real-estate-aerial-video-generator
- AgentPMT main MCP server: https://api.agentpmt.com/mcp/
- AgentPMT REST invoke endpoint: https://api.agentpmt.com/products/purchase

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 279)May include surrounding context.

md
- What AgentPMT is: ../what-is-agentpmt (ClawHub: `what-is-agentpmt`, page: https://clawhub.ai/agentpmt/what-is-agentpmt; skills.sh: `npx skills add AgentPMT/agent-skills --skill what-is-agentpmt`)
- AgentPMT account MCP/REST setup: ../agentpmt-account-mcp-rest-api-setup (ClawHub: `agentpmt-account-mcp-rest-api-setup`, page: https://clawhub.ai/agentpmt/agentpmt-account-mcp-rest-api-setup; skills.sh: `npx skills add AgentPMT/agent-skills --skill agentpmt-account-mcp-rest-api-setup`)
- Marketplace product: https://www.agentpmt.com/marketplace/real-estate-aerial-video-generator
- AgentPMT main MCP server: https://api.agentpmt.com/mcp/
- AgentPMT REST invoke endpoint: https://api.agentpmt.com/products/purchase