ClawHub
Back to skill

Security audit

GutCheck Digestive Health Tracker

Security checks for vulnerabilities and agentic risk

Overview

This skill may install a digestive health app, but it relies on mutable remote code and unpinned command execution that users should review before installing.

Install only if you are comfortable running code fetched from the current state of a remote GitHub repository and npm dependency resolution. Prefer a version that pins the repository commit, uses committed lockfiles with npm ci, documents privacy and medical-safety limits, and removes or hardens the publishing script before use.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (3)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:12
Finding

Mutable Remote Application Is Retrieved and Executed During Installation

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Error
Location
publish_gutcheck.js:28
Finding

Publishing Workflow Executes an Unpinned ClawHub CLI Package Through npx

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
publish_gutcheck.js:98
Finding

Shell Command Injection Through an Unquoted Workspace-Derived Path

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (26)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The declared description presents an end-user digestive health tracking application. However, the supplied code does not implement health tracking, personalized insights, food sensitivity analysis, or gut wellness recommendations. Instead, it is an operational/deployment script for packaging and publishing a skill to ClawHub. This is a materially different primary purpose and involves undeclared capabilities such as filesystem manipulation and external command execution. Therefore, the description does not accurately represent the code's actual behavior.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 57)May include surrounding context.

Setup

  1. After installation, navigate to the gutcheck directory
  2. Create a .env file with required environment variables:
    env
    MONGODB_URI=mongodb://localhost:27017/gutcheck
JWT_SECRET=your-super-secret-jwt-key-here

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 88)May include surrounding context.

md
- `GET /api/auth/me` - Get current user data (requires auth)
- `POST /api/diet/add-meal` - Add a new meal entry
- `GET /api/diet/my-meals` - Get all meals for current user
- `PUT/DELETE /api/diet/my-meals/:id` - Update/delete meal entries

Rp1

Medium
Category
MCP Rug Pull
Confidence
92% confidence
Finding

The instruction uses npx clawhub without pinning an exact package version, so execution may fetch and run whatever version is currently published under that name. In a publishing workflow that requires authentication and may handle privileged tokens or account actions, this creates a supply-chain risk where a malicious or compromised package version could steal credentials or publish tampered content.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
90% confidence
Finding

npx clawhub whoami is also unpinned and may execute an unexpected package version from the registry at runtime. Although this verification step is less sensitive than publishing, it still runs arbitrary code in an authenticated environment and could be abused to collect environment data or tokens.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The unpinned npx clawhub publish command is especially risky because it runs network-fetched code during a privileged action that can publish artifacts and access authenticated account state. If the package or its dependency chain is malicious or compromised, it could alter the upload, exfiltrate credentials, or publish a backdoored skill under the user's account.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
88% confidence
Finding

Recommending npx clawhub login again in troubleshooting repeats the same unsafe pattern of executing an unpinned package from the registry. Because login involves browser-based OAuth and local credential handling, a malicious package version could intercept tokens or manipulate the authentication flow.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
86% confidence
Finding

Even the post-publication verification command npx clawhub search gutcheck runs a package resolved at execution time rather than a fixed version. This is lower impact than login or publish, but it still introduces unnecessary supply-chain exposure and could execute unexpected code on the operator's machine.

Content

No source excerpt is available for this finding.

Unsafe Defaults

Medium
Category
Tool Misuse
Confidence
70% confidence
Finding

Recommending NODE_ENV=development as a default can lead users to run the app with less secure settings, such as verbose errors, weaker operational hardening, or development-only behaviors. In a health-related application handling user data, insecure deployment defaults increase the chance of accidental exposure or misconfiguration.

Content

Scanner excerpt · SKILL.md (reported line 62)May include surrounding context.

MONGODB_URI=mongodb://localhost:27017/gutcheck JWT_SECRET=your-super-secret-jwt-key-here PORT=5000 NODE_ENV=development

text
3. Run the application:
```bash

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

This content plan includes safety-sensitive medical and dietary topics such as supplements, elimination diets, low FODMAP guidance, fermented foods, and medication side effects, but it does not mention any medical disclaimer, escalation guidance, or recommendation to consult qualified professionals. In a digestive-health app, users may interpret educational content as personalized medical advice and act on it in ways that worsen symptoms, delay care, or create medication/diet-related harms.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The manifest describes a digestive health tracking skill that provides personalized insights and wellness recommendations, but this file does not implement any health-tracking or recommendation behavior. Instead, it packages files, creates metadata, and publishes the skill to ClawHub via a CLI command, which is a separate release-engineering function rather than the described skill behavior.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The script invokes npx clawhub without pinning an exact package version, which can cause an arbitrary newer or compromised version of the package to be downloaded and executed at publish time. Because this is a release/publishing script, the executed package runs with the publisher's local permissions and can access source files, tokens, and other sensitive environment data.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
97% confidence
Finding

The publish step executes npx clawhub publish ... without an exact version pin, so npx may resolve and run whatever version is current or maliciously substituted in the registry. In a publishing workflow this is especially dangerous because the command may have access to credentials, package contents, and the ability to alter or exfiltrate release artifacts.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The plan explicitly encourages collecting and amplifying user stories, testimonials, and hashtag-based story sharing in a digestive health context, which can expose sensitive health information such as IBS, food intolerances, and other medical conditions. Because GutCheck is a health-related product, reposting or soliciting this content without clear consent, minimization, and privacy safeguards creates a meaningful risk of unauthorized disclosure of health data and potential regulatory/privacy violations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The community-building section promotes support groups, polls, surveys, comment responses, and live Q&A sessions without any safeguards for handling sensitive digestive-health disclosures. In this context, users are likely to reveal medical symptoms, diagnoses, or treatment details in public or semi-public channels, creating privacy, moderation, and data-handling risks if the organization has no explicit rules for collection, retention, escalation, and removal.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The skill instructs users to clone external code and run npm install and other shell commands without an explicit warning about executing third-party code. In this context, npm install may run lifecycle scripts from dependencies, which can execute arbitrary commands on the host and increase supply-chain risk.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
96% confidence
Finding

The dependency uses a caret range (^4.18.0), which allows installation of newer semver-compatible releases rather than a single reviewed version. This weakens build reproducibility and can unexpectedly introduce vulnerable or behavior-changing transitive code through the software supply chain.

Content

Scanner excerpt · package.json (reported line 19)May include surrounding context.

json
"author": "AetherChain Team",
  "license": "MIT",
  "dependencies": {
    "express": "^4.18.0",
    "mongoose": "^7.0.0",
    "bcrypt": "^5.1.0",
    "jsonwebtoken": "^9.0.0",

Unverifiable Dependency: express has 5 known advisory(ies) (CVE-2024-10491 (Express ressource injection); CVE-2014-6393 (No Charset in Content-Type Header in express); CVE-2024-9266 (Express Open Redirect vulnerability) +2 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
88% confidence
Finding

Because express is not pinned, the manifest does not prove whether the deployed version includes or avoids known advisories. This is dangerous because a web framework is directly exposed to attacker-controlled HTTP input, and uncertainty around its version makes it impossible to verify whether reachable vulnerabilities are present.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
96% confidence
Finding

The mongoose dependency is specified with a caret range, so different installs may resolve to different package versions over time. For a health-data application, this creates avoidable supply-chain and reproducibility risk because an unreviewed update could introduce security defects or incompatible behavior.

Content

Scanner excerpt · package.json (reported line 20)May include surrounding context.

json
"license": "MIT",
  "dependencies": {
    "express": "^4.18.0",
    "mongoose": "^7.0.0",
    "bcrypt": "^5.1.0",
    "jsonwebtoken": "^9.0.0",
    "cors": "^2.8.5",

Unverifiable Dependency: mongoose has 9 known advisory(ies) (CVE-2026-73562 (Mongoose: Prototype pollution in mongoose update casting via __proto__-prefixed ); CVE-2019-17426 (Improper Input Validation in Automattic Mongoose); CVE-2023-3696 (Mongoose Prototype Pollution vulnerability) +6 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
89% confidence
Finding

The unpinned mongoose version makes it impossible to verify whether known vulnerabilities, including input validation or prototype-pollution issues, affect the installed release. Since mongoose processes database queries and object mapping, this uncertainty is more serious in an app likely storing sensitive health records.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
95% confidence
Finding

Using a ranged version for bcrypt means the deployed cryptographic library version may drift between environments or over time. That undermines deterministic builds and can expose the application to newly introduced package or native module issues without explicit review.

Content

Scanner excerpt · package.json (reported line 21)May include surrounding context.

json
"dependencies": {
    "express": "^4.18.0",
    "mongoose": "^7.0.0",
    "bcrypt": "^5.1.0",
    "jsonwebtoken": "^9.0.0",
    "cors": "^2.8.5",
    "dotenv": "^16.0.3"

Unverifiable Dependency: bcrypt has 1 known advisory(ies) (CVE-2020-7689 (Integer Overflow or Wraparound and Use of a Broken or Risky Cryptographic Algori)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
82% confidence
Finding

The bcrypt dependency is not pinned, so the manifest cannot establish whether the installed package is affected by the cited advisory. This creates avoidable uncertainty around a cryptographic component, though the package's current major version suggests the specific known issue may not apply.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
97% confidence
Finding

jsonwebtoken is security-sensitive, and allowing semver-compatible automatic upgrades without exact pinning increases the risk of pulling in flawed authentication logic or unexpected behavior. In an application likely handling user accounts and health data, auth-library supply-chain drift is more dangerous than for non-sensitive utilities.

Content

Scanner excerpt · package.json (reported line 22)May include surrounding context.

json
"express": "^4.18.0",
    "mongoose": "^7.0.0",
    "bcrypt": "^5.1.0",
    "jsonwebtoken": "^9.0.0",
    "cors": "^2.8.5",
    "dotenv": "^16.0.3"
  }

Unverifiable Dependency: jsonwebtoken has 4 known advisory(ies) (CVE-2022-23539 (jsonwebtoken unrestricted key type could lead to legacy keys usage ); CVE-2015-9235 (Verification Bypass in jsonwebtoken); CVE-2022-23541 (jsonwebtoken's insecure implementation of key retrieval function could lead to F) +1 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
91% confidence
Finding

jsonwebtoken is a core authentication component, and without exact pinning there is no assurance that the installed version avoids known verification and key-handling flaws. In a health application that may protect user sessions and personal data, uncertainty in token verification can lead to account compromise or unauthorized data access.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
95% confidence
Finding

The cors package is not pinned to an exact version, so installations are not fully reproducible. While lower risk than auth or database libraries, unreviewed updates in request-handling middleware can still alter security-relevant behavior.

Content

Scanner excerpt · package.json (reported line 23)May include surrounding context.

json
"mongoose": "^7.0.0",
    "bcrypt": "^5.1.0",
    "jsonwebtoken": "^9.0.0",
    "cors": "^2.8.5",
    "dotenv": "^16.0.3"
  }
}

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
publish_gutcheck.js:28