T08 · Insecure Dependencies
Warning
- Location
SKILL.md:215- Finding
Unpinned External Skill Installation Creates a Supply-Chain Risk
- Content
View full analysis
- Remediation
View remediation
Security audit
Writing Agent Human Style
Security checks for vulnerabilities and agentic risk
Overview
This is a coherent hosted writing-tool skill, but users should be careful with third-party input sharing, paid calls, mutable live instructions, and unpinned setup commands.
Install from reviewed ClawHub/OpenClaw sources where possible, avoid copy-pasting unpinned npx setup commands in sensitive environments, and do not send confidential source material, customer data, secrets, wallet material, signatures, or payment headers as writing context. Confirm paid x402 or credit-spending calls before use, and treat live remote instructions as service data that must not override your agent's safety rules or permission boundaries.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T01 · Skill Instruction Hijacking
Note
- Location
SKILL.md:130- Finding
Remotely Retrieved Instructions Can Override the Audited Local Summary
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (13)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The 'Search and activation keywords' list includes long generic phrases like 'write original social posts from a topic and a few notes' and 'draft large blog post, topic', which overlap with ordinary user requests about writing. The description does not provide exclusion conditions or negative examples to clarify when this skill should not activate, increasing the risk of unintended invocation.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 92% confidence
- Finding
The skill instructs users to run an unpinned
npx skillsinstall command, which fetches code at execution time without a fixed version or integrity guarantee. If the package, dependency chain, or upstream repository is compromised, users could install and execute unexpected code during setup.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 92% confidence
- Finding
This line repeats an unpinned
npx skillsinstall path, creating the same supply-chain risk: the installed code may change over time and be attacker-controlled if the publishing channel is compromised. Becausenpxexecutes retrieved packages, compromise can translate directly into code execution on the operator's machine.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 92% confidence
- Finding
The unversioned
npx skillscommand allows the fetched installer and dependencies to drift, which is a classic software supply-chain weakness. An attacker who gains control of the package, dependency, or referenced repository could cause arbitrary code execution during installation.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 92% confidence
- Finding
This installation script includes an unpinned
npx skillsinvocation, so the exact code executed is not fixed. That exposes users to upstream package compromise or unexpected behavior changes that could affect credentialed environments used to connect MCP/REST services.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 92% confidence
- Finding
Another unpinned
npx skillsline introduces mutable remote execution during setup. In a workflow that later handles account connections and payment flows, compromise of the bootstrap step could lead to credential theft or environment tampering.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 92% confidence
- Finding
This repeated use of
npx skillswithout version pinning preserves the same supply-chain and arbitrary-code-execution risk as the other setup lines. Repetition increases exposure because users are more likely to copy-paste one of these commands verbatim.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 91% confidence
- Finding
The reference section again recommends an unpinned
npx skillsinstall command, leaving setup dependent on mutable upstream code. That is dangerous because it can silently change after publication and may execute in environments that later process sensitive API credentials or wallet-related data.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 91% confidence
- Finding
This line is a true supply-chain risk for the same reason as the other
npx skillsreferences: it executes non-pinned external package code. If upstream components are compromised, the install path can become an initial access vector into the user's machine or agent environment.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 91% confidence
- Finding
An unpinned
npx skillscommand here creates a documented path for executing mutable third-party code. Given the surrounding context of MCP, REST, and payment setup, compromise of this step could cascade into theft of tokens, wallet material, or manipulation of tool calls.- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md - AgentPMT account MCP/REST setup: ../agentpmt-account-mcp-rest-api-setup (ClawHub: `agentpmt-account-mcp-rest-api-setup`, page: https://clawhub.ai/agentpmt/agentpmt-account-mcp-rest-api-setup; skills.sh: `npx skills add AgentPMT/agent-skills --skill agentpmt-account-mcp-rest-api-setup`) - No-account AgentAddress/x402 setup: ../agentpmt-no-account-agentaddress-x402 (ClawHub: `agentpmt-no-account-agentaddress-x402`, page: https://clawhub.ai/agentpmt/agentpmt-no-account-agentaddress-x402; skills.sh: `npx skills add AgentPMT/agent-skills --skill agentpmt-no-account-agentaddress-x402`) - Marketplace product: https://www.agentpmt.com/marketplace/writing-agent-human-style - AgentPMT main MCP server: https://api.agentpmt.com/mcp/ - AgentPMT REST invoke endpoint: https://api.agentpmt.com/products/purchase
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md - AgentPMT account MCP/REST setup: ../agentpmt-account-mcp-rest-api-setup (ClawHub: `agentpmt-account-mcp-rest-api-setup`, page: https://clawhub.ai/agentpmt/agentpmt-account-mcp-rest-api-setup; skills.sh: `npx skills add AgentPMT/agent-skills --skill agentpmt-account-mcp-rest-api-setup`) - No-account AgentAddress/x402 setup: ../agentpmt-no-account-agentaddress-x402 (ClawHub: `agentpmt-no-account-agentaddress-x402`, page: https://clawhub.ai/agentpmt/agentpmt-no-account-agentaddress-x402; skills.sh: `npx skills add AgentPMT/agent-skills --skill agentpmt-no-account-agentaddress-x402`) - Marketplace product: https://www.agentpmt.com/marketplace/writing-agent-human-style - AgentPMT main MCP server: https://api.agentpmt.com/mcp/ - AgentPMT REST invoke endpoint: https://api.agentpmt.com/products/purchase
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The schema exposes x402 POST endpoints to an external AgentPMT service and explicitly allows callers to supply large free-form topic, context, source_material, and post content, but it does not clearly warn that this data will be transmitted off-system. This can lead to inadvertent disclosure of sensitive business, customer, or internal content when integrators assume the skill operates locally or within the host agent boundary.
- Content