Cashclaw Landing Page

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:44 AM UTC
• Version: 1.0.0

Overview

The skill mostly matches its landing-page purpose, but it installs and runs an unpinned third-party npm package whose reviewed code is not included.

Review the npm package publisher and source before installing, prefer a pinned reviewed version with integrity verification, and run it in a least-privilege project environment without unnecessary secrets available.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:13

Finding

Unpinned Third-Party npm Dependency

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 13–15
Vulnerability Type: Unpinned and unaudited third-party dependency
Risk Level: Medium

json

"kind": "node",
"package": "cashclaw",
"bins": ["cashclaw"]

Technical Analysis

The skill metadata directs the host to install the cashclaw package from npm without specifying an exact version, integrity hash, lockfile, or verified source repository. Consequently, installation can resolve mutable registry content that was not included in the audited project.

An npm package can execute lifecycle scripts during installation. The documented workflow also invokes the installed cashclaw executable, creating another code-execution point. If the package, publisher account, or distribution channel is compromised—or if a future release becomes malicious—the effective code executed by the skill can differ from the code originally reviewed.

The repository contains only SKILL.md; the dependency implementation is not available for source-level verification. This finding therefore identifies an exposed supply-chain execution path, not confirmed malicious behavior by a particular package release.

Attack Path

1. An attacker compromises the npm package, its publisher account, or its release pipeline and publishes a malicious version.
2. The skill host processes the installation metadata and resolves cashclaw without an exact version or integrity constraint.
3. npm downloads the attacker-controlled release.
4. Malicious npm lifecycle scripts may execute during installation with the privileges of the installing user.
5. Alternatively, the user or agent runs one of the documented cashclaw landing ... commands, executing the compromised package binary.
6. The malicious code can act within the installing user's permissions and access resources available to that process.

Impact Assessment

Successful exploitation could provide arbitrary code execution with the privileges of the user or ...[truncated 586 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin cashclaw to a reviewed, exact version rather than resolving the latest compatible registry release.
2. Verify the package using a trusted lockfile and registry integrity digest.
3. Audit and retain the source code corresponding to the pinned package version.
4. Verify the npm publisher, package provenance, and official source repository before installation.
5. Disable npm lifecycle scripts during installation where operationally feasible, then explicitly run only reviewed setup steps.
6. Install and execute the package in a least-privilege, isolated environment with restricted filesystem, secret, and network access.
7. Continuously monitor the pinned dependency for ownership changes, compromised releases, vulnerabilities, and unexpected lifecycle-script changes.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill description advertises a broad capability to create landing pages but does not define clear invocation boundaries, trigger conditions, or exclusions. In agent environments, this can cause the skill to be invoked in unintended contexts, leading to overbroad execution, user confusion, or application to unsafe/sensitive requests without sufficient qualification.

Content

No source excerpt is available for this finding.