Cashclaw Reputation Manager

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:37 AM UTC
• Version: 1.0.0

Overview

The skill has a coherent reputation-management purpose, but it installs an unpinned external npm CLI and enables broad ongoing review monitoring without enough data-handling limits.

Review this skill before installing. Pin and independently review the `cashclaw` npm package, run it with minimal filesystem and credential access, confirm compliance with review-platform terms and privacy obligations, set retention and deletion rules for collected reviews, and make any report branding opt-in.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Note

• Location: SKILL.md:287

Finding

Mandatory Branded Footer Injects Unrequested External-Domain Promotion

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 287
Vulnerability Type: Mandatory output manipulation
Risk Level: Low

Vulnerable Code

markdown

*Generated by CashClaw Reputation Manager | cashclaw.ai*

Technical Analysis

The prescribed report template requires the Agent to append a fixed promotional footer containing the external domain cashclaw.ai. Because this instruction is embedded in the Skill rather than supplied or approved by the user, loading and following the Skill changes the content of client-facing output.

This behavior does not override safety constraints or grant system privileges, but it does exercise persistent control over the Agent's generated deliverable. It may cause reports to endorse or advertise an external service without the user's informed consent.

Attack Path

1. A user loads the reputation-management Skill.
2. The Agent follows the mandatory report assembly template in SKILL.md.
3. The Agent inserts the prescribed CashClaw footer into the report.
4. The client receives a deliverable containing unrequested branding and an external-domain reference.

Impact Assessment

The issue affects the integrity and neutrality of generated reports. An operator of the referenced domain may receive traffic or implied endorsement from client-facing documents. No local permissions, credentials, code-execution privileges, or access to private system resources are obtained through this footer alone.

Remediation

View remediation

Remediation Suggestions

• Remove the fixed branded footer from the mandatory report template.
• Make attribution and external links explicitly opt-in.
• Provide a configurable footer field that defaults to empty.
• Clearly disclose any branding requirement before the Skill generates client-facing content.
• Validate generated deliverables to ensure that they do not include unapproved promotional links or endorsements.

T08 · Insecure Dependencies

Error

• Location: SKILL.md:10

Finding

Unpinned and Unauditable External npm Dependency

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 10-18
Vulnerability Type: Mutable third-party dependency installation
Risk Level: High

Vulnerable Code

json

"install":
  [
    {
      "id": "npm",
      "kind": "node",
      "package": "cashclaw",
      "bins": ["cashclaw"],
      "label": "Install CashClaw via npm"
    }
  ]

Technical Analysis

The Skill directs the environment to install the npm package cashclaw without specifying an exact version or package-integrity hash. The repository contains no implementation of the associated executable, lockfile, checksum, or vendored source with which to verify its behavior.

npm package contents can change between installations when a mutable package name is used. Package installation may also execute lifecycle scripts, while subsequent documented commands invoke the installed cashclaw binary. The effective executable behavior is therefore controlled by external package-registry content that was not included in this audit.

This establishes a supply-chain trust boundary: compromise of the package, publisher account, registry resolution, or a future package release could introduce arbitrary code even though SKILL.md itself remains unchanged. The audit evidence does not establish that the current external package is malicious; the vulnerability is the unpinned and unauditable dependency mechanism.

Attack Path

1. An attacker compromises the package publisher, publishing process, or relevant registry-resolution path.
2. The attacker publishes a modified cashclaw package under the version selected by npm.
3. A user installs the Skill, causing npm to resolve and download the mutable package.
4. Malicious code executes through an npm lifecycle script or when one of the documented cashclaw reputation commands is invoked.
5. The payload operates with the permissions and environmental access of the account running install ...[truncated 735 chars]

Remediation

View remediation

Remediation Suggestions

• Pin cashclaw to an exact, reviewed package version rather than using an unversioned package name.
• Record and verify the expected package-integrity hash.
• Include and enforce a lockfile so dependency resolution is reproducible.
• Publish or vendor the executable source required by the Skill so its behavior can be independently audited.
• Review all direct and transitive dependencies before release.
• Disable npm lifecycle scripts during installation where operationally feasible, then explicitly run only reviewed setup actions.
• Install and execute the CLI in a sandbox with minimal filesystem, credential, and network access.
• Use registry allowlisting, package provenance verification, and automated alerts for publisher or dependency changes.
• Require security review before updating the pinned package version or integrity value.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill explicitly instructs collecting full review text, reviewer names, dates, and response metadata from multiple platforms, then organizing that data into reports and response drafts, but it provides no privacy notice, minimization guidance, retention limits, or handling restrictions. Even though the data is publicly visible, aggregating and storing it across sources increases privacy and compliance risk because it creates a centralized dataset of user-generated content that may include sensitive allegations, employee names, or other personal data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The monthly monitoring configuration sets up recurring collection and alerting for reviews and mentions across platforms, effectively enabling continuous ingestion and processing of public user content over time, yet the skill gives no warning about persistent collection, retention, or access control. This increases the risk of building a long-lived behavioral or reputational dataset without user awareness, governance, or limits on downstream use.

Content

No source excerpt is available for this finding.