ClawHub
Back to skill

Security audit

Agent Rating Protocol

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent agent-reputation helper that mainly documents local rating-file workflows, with a disclosed but unpinned PyPI dependency users should install cautiously.

Install this only in an isolated Python environment and consider pinning or auditing the agent-rating-protocol package before use. Expect it to read and write local rating store files such as ratings.jsonl; do not point it at sensitive files unless you have reviewed the package code.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:29
Finding
Unpinned Third-Party Package Installation## Vulnerability Details **File Location**: `SKILL.md`, lines 29–35 **Vulnerability Type**: Unpinned third-party dependency installation **Risk Level**: Medium **Vulnerable Code**: ```markdown ## Setup The `agent-rating-protocol` Python package must be installed. If not available, install it: ```bash pip install agent-rating-protocol ``` ``` ### Technical Analysis The skill directs users to install `agent-rating-protocol` from PyPI without specifying an exact version or verifying a cryptographic hash. Consequently, the effective code installed by this command may change after the skill has been reviewed. The dependency's source code is not included in the audited project. Its installation behavior and runtime operations—including local file access and network activity—therefore cannot be verified against the security claims in `SKILL.md`. This finding establishes a supply-chain exposure; it does not establish that the current PyPI package is malicious. ### Attack Path 1. An attacker compromises the package publisher account, distribution process, or another part of the package supply chain. 2. The attacker publishes a malicious or compromised release under the expected package name. 3. A user follows the documented setup instruction and runs `pip install agent-rating-protocol`. 4. Because no version or hash is fixed, pip resolves and downloads the attacker-controlled release. 5. Malicious installation hooks or package code execute when the package is installed or imported by the documented Python examples. ### Impact Assessment Malicious dependency code could execute with the operating-system privileges of the user running pip or invoking the skill. Within those privileges, it could read or modify accessible files, access environment data, initiate network connections, tamper with rating records, or execute additional commands. The precise impact depends on the invoking user's permissions and execution envir ...[truncated 69 chars]
Remediation
## Remediation Suggestions - Pin the dependency to a specifically reviewed version, for example with an exact `==` constraint. - Distribute and verify cryptographic hashes, using a locked requirements file and `pip install --require-hashes`. - Audit the dependency's source, build configuration, installation hooks, and transitive dependencies before approving it. - Provide a reproducible lockfile and integrity metadata in the skill package. - Install the dependency in an isolated virtual environment or sandbox under a non-privileged account. - Use a trusted package index configuration and monitor the approved release for publisher-account or artifact changes. - Reassess the dependency before updating the pinned version.

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Credential Access

High
Category
Privilege Escalation
Content
**What it cannot do:**
- Cannot access files outside your working directory beyond what you explicitly specify
- Cannot make purchases, send emails, or take irreversible actions
- Cannot access credentials, environment variables, or secrets

**License:** Apache 2.0
Confidence
70% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Static analysis

No suspicious patterns detected.