Cashclaw Competitor Analyzer

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 9:42 AM UTC
• Version: 1.0.0

Overview

This skill is a coherent competitor-research/reporting tool, with ordinary caution needed for its unpinned npm CLI dependency and generated reports containing public company data.

Install only if you are comfortable using the current npm cashclaw package in your environment. Review generated reports before storing or sharing them, especially because they may contain aggregated third-party business data and a CashClaw attribution footer.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Note

• Location: SKILL.md:241

Finding

Mandatory Promotional Content Injected into Generated Reports

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:241-258
Vulnerability Type: Forced promotional output through skill instructions
Risk Level: Low

Vulnerable Code

markdown

## Methodology
{Data sources used, date of research, limitations}

---
*Generated by CashClaw Competitor Analyzer | cashclaw.ai*

Technical Analysis

The required report template directs the agent to append CashClaw branding and the external domain cashclaw.ai to generated deliverables. This content is unrelated to the substantive competitor analysis requested by the user and is presented as a mandatory component of the final report.

Because skill instructions influence the agent's active behavior, mandatory insertion of attacker-selected promotional content constitutes a limited form of instruction hijacking. It affects output integrity rather than changing system permissions or bypassing safety controls. The audited text does not instruct the agent to access the domain, transmit information to it, or execute content obtained from it.

Attack Path

1. A user activates the competitor-analysis skill.
2. The agent loads and follows the report assembly instructions in SKILL.md.
3. The agent generates a competitor-analysis report using the prescribed template.
4. The mandatory footer causes the resulting report to advertise cashclaw.ai, regardless of whether the user requested or approved that attribution.
5. The branded output may then be delivered to the user or redistributed as part of a client report.

Impact Assessment

The issue can alter generated report content and provide recurring exposure for an external brand and domain. It may reduce report neutrality, create undisclosed commercial influence, and cause users to distribute promotional content unknowingly.

No operating-system privileges, credentials, persistent storage, or code-execution capabilities are obtained through this instruction alone. Its ...[truncated 55 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the mandatory CashClaw footer from the report template.
• If attribution is necessary, make it explicitly optional and obtain user approval before including it.
• Separate report-generation requirements from promotional or commercial content.
• Clearly disclose any affiliation with the named service or domain.
• Add a quality-control requirement that generated reports contain only user-requested branding and links.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:7

Finding

Unpinned Third-Party npm Package Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:7-19
Vulnerability Type: Unversioned third-party dependency
Risk Level: Medium

Vulnerable Code

yaml

"openclaw":
  {
    "emoji": "\U0001F4CA",
    "requires": { "bins": ["node", "curl"] },
    "install":
      [
        {
          "id": "npm",
          "kind": "node",
          "package": "cashclaw",
          "bins": ["cashclaw"],
          "label": "Install CashClaw via npm"
        }
      ]
  }

Technical Analysis

The installation metadata identifies the npm package cashclaw without specifying an exact version or cryptographic integrity value. Consequently, installation may resolve to whichever package release the registry serves at installation time. The effective executable dependency can therefore change after this skill has been reviewed.

The package source and implementation are not included in the audited project, which contains only SKILL.md. The audit therefore cannot verify the dependency's package lifecycle scripts, transitive dependencies, CLI behavior, provenance, or integrity.

This is a supply-chain exposure rather than proof that the current npm package is malicious. Exploitation would require compromise or hostile modification of the package, its maintainer account, its dependency graph, the package registry, or the dependency-resolution process.

Attack Path

1. An attacker compromises the cashclaw package, a maintainer account, a transitive dependency, or the relevant package-distribution channel.
2. The attacker publishes a malicious release or otherwise influences dependency resolution.
3. A user installs the skill, and the unpinned package declaration resolves to the attacker-controlled release.
4. Malicious package lifecycle scripts may execute during installation, or malicious logic may execute when the documented cashclaw analyze commands are invoked.
5. The dependency operates w ...[truncated 799 chars]

Remediation

View remediation

Remediation Suggestions

• Pin cashclaw to a specific, reviewed version rather than allowing the latest release to resolve dynamically.
• Verify package integrity using a lockfile and registry-provided cryptographic integrity metadata.
• Record and verify package provenance, publisher identity, release signatures, and source repository.
• Audit the pinned package, its lifecycle scripts, and all transitive dependencies before deployment.
• Disable npm lifecycle scripts during installation where they are unnecessary.
• Prefer vendoring reviewed executable code or distributing it through a controlled internal registry.
• Run installation and CLI execution in a least-privilege sandbox with restricted filesystem, environment-variable, credential, and network access.
• Establish dependency monitoring and a controlled update process so new versions require review before adoption.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill explicitly instructs collection, comparison, and storage of third-party/company data in deliverables, including company profiles, pricing, social metrics, reviews, and structured JSON outputs, but it does not warn users that generated artifacts may contain retained third-party data. This creates a transparency and data-handling risk: users may unknowingly store scraped or aggregated external business data in files that persist beyond the session and could later be shared or redistributed without review.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.