ClawHub
Back to skill

Security audit

Curatr

Security checks for vulnerabilities and agentic risk

Overview

Curatr is a purpose-aligned health-record quality skill that discloses patient approval and audit tracking for fixes, but its dependency setup and resource-coverage claims need careful review.

Before installing, verify the HealthClaw stack source, pin or lock the npm and Python dependencies, keep STEP_UP_SECRET limited to the runtime that needs it, and treat non-Condition resource checks as limited unless the implementation proves fuller validation.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:13
Finding

Unpinned and Unverified Third-Party Dependencies

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 13
Vulnerability Type: Supply-chain exposure through mutable dependency resolution
Risk Level: Medium

Vulnerable Code:

yaml
metadata: {"openclaw":{"requires":{"env":["STEP_UP_SECRET"],"bins":["node","python3"]},"install":[{"kind":"node","packages":["@modelcontextprotocol/sdk","express","node-fetch"]},{"kind":"uv","packages":["flask","flask-sqlalchemy","requests"]}],"primaryEnv":"STEP_UP_SECRET"}}

Technical Analysis

The Skill metadata instructs the runtime to install six npm and Python dependencies without exact versions, lockfiles, hashes, or other integrity constraints. Package managers may therefore resolve different versions over time. A subsequently compromised, malicious, or incompatible release could be installed even though it was not part of the audited artifact.

The artifact contains only SKILL.md and no executable implementation demonstrating that these packages are necessary. Automatically installing all six packages therefore exceeds the minimum privileges and components demonstrably required by the submitted artifact. The audit found no evidence that the currently named packages are malicious; the confirmed issue is the unsafe, mutable dependency-resolution configuration.

Attack Path

  1. An Agent loads or installs the Skill and processes its installation metadata.
  2. npm and the Python package installer resolve the unversioned package names against their configured registries.
  3. A compromised account, malicious future release, registry compromise, or dependency-resolution change supplies code that was not reviewed with the Skill.
  4. The package manager downloads and installs that code.
  5. Installation hooks, package initialization, or later imports may execute the unreviewed code with the privileges of the Skill installer or runtime.
  6. Such code could access files, environment variables—including STEP_UP_SECRET if inhe ...[truncated 763 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove all dependencies that are not required by executable code contained in the Skill.
  2. Pin every npm and Python dependency to an exact reviewed version rather than allowing mutable resolution.
  3. Include package-manager lockfiles and enforce frozen or locked installation modes.
  4. Verify package integrity using registry integrity metadata or approved cryptographic hashes.
  5. Review transitive dependencies and use automated vulnerability and provenance checks in CI.
  6. Disable package installation scripts where they are not required.
  7. Install and run dependencies under a dedicated, non-privileged account with restricted filesystem and network access.
  8. Avoid exposing STEP_UP_SECRET to package-installation processes; inject it only into the specific runtime component that validates step-up tokens.
  9. Document why each dependency and runtime binary is necessary so the requested installation footprint can be assessed against least-privilege requirements.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (3)

Memory Manipulation

High
Category
Memory Poisoning
Confidence
80% confidence
Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · SKILL.md (reported line 186)May include surrounding context.

md
- **Reason code**: `PATADMIN` (patient administration)

The original source record is preserved in the AuditEvent trail. Provenance
does not erase history — it adds attribution.

## Provider Correction Request

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The documentation presents six FHIR resource types as supported with resource-specific checks, but later states that only Condition is primarily supported and others receive generic coding scans. In a patient-facing healthcare correction tool, this can mislead users or downstream agents into trusting incomplete validation and applying corrections based on weaker-than-advertised review.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 172)May include surrounding context.

md
|---|---|---|
| `critical` | Code system deprecated or structurally broken | ICD-9 code in 2026 |
| `warning` | Code invalid or display name wrong | Invalid clinicalStatus value |
| `info` | Recommended field missing | No verificationStatus |
| `suggestion` | A better value exists | Display name differs from canonical |

## Provenance — What Gets Recorded