ClawHub
Back to skill

Security audit

Send A Custom Greeting Card

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent AgentPMT skill for creating and mailing physical greeting cards, with privacy, payment, and install-supply-chain cautions but no evidence of hidden or malicious behavior.

Installers should prefer the ClawHub/OpenClaw route or pinned, verified package versions instead of unpinned npx commands. Before using create_proof or send, confirm that the recipient address and card contents may be sent to AgentPMT and downstream print/mail providers, and require explicit user approval because send spends credits and initiates physical USPS delivery.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:386
Finding

Unpinned Third-Party Package and Skill Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 386-396
Vulnerability Type: Unpinned third-party dependency execution
Risk Level: Medium

Vulnerable Code

markdown
- What AgentPMT is: ../what-is-agentpmt
  - ClawHub page: https://clawhub.ai/agentpmt/what-is-agentpmt
  - OpenClaw install: `openclaw skills install what-is-agentpmt`
  - skills.sh install: `npx skills add AgentPMT/agent-skills --skill what-is-agentpmt`
- AgentPMT account MCP/REST setup: ../agentpmt-account-mcp-rest-api-setup
  - ClawHub page: https://clawhub.ai/agentpmt/agentpmt-account-mcp-rest-api-setup
  - OpenClaw install: `openclaw skills install agentpmt-account-mcp-rest-api-setup`
  - skills.sh install: `npx skills add AgentPMT/agent-skills --skill agentpmt-account-mcp-rest-api-setup`

skills.sh install script:

```bash
npx skills add AgentPMT/agent-skills --skill what-is-agentpmt
npx skills add AgentPMT/agent-skills --skill agentpmt-account-mcp-rest-api-setup
text

The same unpinned `npx` installation instructions are repeated at `SKILL.md:457-458`.

### Technical Analysis

The Skill directs users or agents to invoke `npx skills` and install Skill content from `AgentPMT/agent-skills` without pinning the CLI package to an exact reviewed version or pinning the remote source to an immutable commit or signed release.

`npx` can retrieve and execute package code from the configured npm registry. Mutable package versions and repository branches allow the effective installation payload to change after this Skill has been audited. Consequently, the security of the setup procedure depends on third-party package publishing accounts, registry integrity, repository integrity, and name resolution at installation time.

The related automatic freshness instruction at `SKILL.md:14` increases exposure by recommending reinstallation whenever the document is more than seven days old, without requiring integrity verification.

### Attack Path

1. An attacker compromises the npm 
...[truncated 1242 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin the skills CLI to an exact reviewed version, for example by using an exact package version rather than an unqualified npx skills invocation.
  2. Pin AgentPMT/agent-skills to an immutable commit hash or cryptographically signed release instead of a mutable branch or latest version.
  3. Publish and verify cryptographic checksums or signatures for downloaded Skill artifacts before installation.
  4. Use a lockfile or equivalent integrity metadata where the installation mechanism supports it.
  5. Prefer a pre-reviewed local installation artifact over runtime retrieval and execution.
  6. Replace automatic age-based reinstallation with a process that first verifies the source, version, signature, release notes, and requested permission changes.
  7. Run installation in a sandbox or minimally privileged account without access to unrelated credentials and sensitive files.
  8. Document the expected package publisher, repository identity, version, commit, and verification procedure so users can detect substitution.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (14)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill collects recipient name and mailing address and sends them to external print/mailing providers, but it does not require an explicit user-facing disclosure or consent step about third-party processing. Because this is a physical-mail service, the transmitted data includes sensitive personal contact information and message contents, increasing privacy and compliance risk if the agent acts without clear notice.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The activation keywords are broad enough to match ordinary social or business communication tasks, which can cause the agent to invoke a third-party mailing workflow unexpectedly. In this context, accidental invocation is meaningful because the skill can send physical mail and process recipient PII, potentially causing privacy exposure, cost, or unauthorized outbound actions.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 460)May include surrounding context.

md
- What AgentPMT is: ../what-is-agentpmt (ClawHub: `what-is-agentpmt`, page: https://clawhub.ai/agentpmt/what-is-agentpmt; skills.sh: `npx skills add AgentPMT/agent-skills --skill what-is-agentpmt`)
- AgentPMT account MCP/REST setup: ../agentpmt-account-mcp-rest-api-setup (ClawHub: `agentpmt-account-mcp-rest-api-setup`, page: https://clawhub.ai/agentpmt/agentpmt-account-mcp-rest-api-setup; skills.sh: `npx skills add AgentPMT/agent-skills --skill agentpmt-account-mcp-rest-api-setup`)
- Marketplace product: https://www.agentpmt.com/marketplace/send-a-greeting-card
- AgentPMT main MCP server: https://api.agentpmt.com/mcp/
- AgentPMT REST invoke endpoint: https://api.agentpmt.com/products/purchase

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 461)May include surrounding context.

md
- What AgentPMT is: ../what-is-agentpmt (ClawHub: `what-is-agentpmt`, page: https://clawhub.ai/agentpmt/what-is-agentpmt; skills.sh: `npx skills add AgentPMT/agent-skills --skill what-is-agentpmt`)
- AgentPMT account MCP/REST setup: ../agentpmt-account-mcp-rest-api-setup (ClawHub: `agentpmt-account-mcp-rest-api-setup`, page: https://clawhub.ai/agentpmt/agentpmt-account-mcp-rest-api-setup; skills.sh: `npx skills add AgentPMT/agent-skills --skill agentpmt-account-mcp-rest-api-setup`)
- Marketplace product: https://www.agentpmt.com/marketplace/send-a-greeting-card
- AgentPMT main MCP server: https://api.agentpmt.com/mcp/
- AgentPMT REST invoke endpoint: https://api.agentpmt.com/products/purchase

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The send action initiates real-world mail delivery and requires a recipient's physical address, but the schema does not explicitly warn that this personal data will be transmitted to a third-party print-and-mail provider and that the action causes irreversible physical dispatch. In an agent setting, this increases the risk of users or upstream agents triggering disclosure of personal address data or sending unwanted mail without fully informed consent.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.