ClawHub
Back to skill

Security audit

Submit Work

Security checks for vulnerabilities and agentic risk

Overview

This skill is meant to submit OpenAnt work, but it allows external file uploads and task submissions without user confirmation.

Install only if you are comfortable with an agent submitting OpenAnt work and uploading deliverable files automatically. Before use, constrain it to explicit OpenAnt submission requests, review which files count as deliverables, avoid sensitive local outputs, and prefer a pinned reviewed CLI version instead of `@latest`.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:5
Finding

Unpinned Third-Party CLI Execution Through a Mutable npm Tag

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:5, 10, 29-41
Vulnerability Type: Supply-chain risk caused by executing an unpinned npm dependency
Risk Level: Medium

Vulnerable Code

yaml
allowed-tools: ["Bash(npx @openant-ai/cli@latest status*)", "Bash(npx @openant-ai/cli@latest upload *)", "Bash(npx @openant-ai/cli@latest tasks submit *)", "Bash(npx @openant-ai/cli@latest tasks withdraw *)", "Bash(npx @openant-ai/cli@latest tasks get *)"]
markdown
Use the `npx @openant-ai/cli@latest` CLI to submit completed work for a task you're assigned to.
bash
npx @openant-ai/cli@latest status --json
bash
npx @openant-ai/cli@latest upload <file-path> --json

Technical Analysis

The skill repeatedly instructs the agent to execute @openant-ai/cli through npx using the mutable @latest distribution tag. The package version and integrity digest are not pinned.

When the command is invoked, npx may retrieve and execute whichever package release the npm registry maps to latest at that moment. Consequently, the effective executable can change after this skill has been reviewed, without any modification to the audited repository. This prevents the audit from establishing that future executions will use the same code.

This creates a supply-chain exposure if the package publisher, maintainer account, npm publication process, package itself, or a transitive dependency is compromised. The audit did not establish that the current package is malicious; the vulnerability is the unsafe and non-reproducible dependency execution mechanism.

Attack Path

  1. An attacker compromises the package maintainer account, publication token, release process, or relevant dependency chain.

  2. The attacker publishes a malicious version of @openant-ai/cli and assigns it to the latest tag.

  3. An agent invokes this skill and runs an allowed command such as:

    bash
    npx @openant-ai/cli@latest status --json

  4. npx r ...[truncated 1111 chars]

Remediation
View remediation

Remediation Suggestions

  1. Replace @latest with an exact, reviewed package version in every command and in allowed-tools, for example:

    bash
    npx --yes @openant-ai/cli@1.2.3 status --json

  2. Prefer installing the CLI through a controlled dependency workflow with a committed lockfile and verified registry integrity metadata rather than downloading it at invocation time.

  3. Pin and review transitive dependencies. Use automated dependency scanning, provenance verification, and package-signature or trusted-publisher validation where available.

  4. Test and review each proposed package upgrade before changing the pinned version. Do not automatically track mutable npm tags.

  5. Execute the CLI in a least-privilege sandbox with:

    • Access limited to required deliverable paths.
    • Minimal environment variables and credentials.
    • Restricted network destinations.
    • No access to unrelated repositories, SSH keys, or user configuration.
    • A non-administrative operating-system account.

  6. Update every command example and allowlist entry consistently so that no fallback path continues to invoke @latest.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (21)

Missing User Warnings

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill explicitly instructs the agent to upload all output files and submit work 'without asking' and 'no confirmation needed'. This creates a direct risk of unreviewed exfiltration of locally generated artifacts, which may include sensitive documents, secrets, internal screenshots, or other data that the user did not intend to transmit to a third-party service.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

MCP server references in the skill manifest without version pinning are a rug-pull risk.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill advertises very broad trigger phrases like 'I'm done', 'here's my work', and 'deliver results', which overlap with common conversational language. In an agent environment, that can cause the skill to activate in situations where the user did not intend external submission or file transfer, increasing the chance of accidental data disclosure or unintended task state changes.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
97% confidence
Finding

Telling the agent to 'execute immediately' with 'No confirmation needed' authorizes autonomous external actions that can change remote state and transmit data. In the context of a submission skill, that materially increases the chance of accidental submission of incomplete work, leakage of sensitive information, or irreversible workflow actions taken without informed user consent.

Content

Scanner excerpt · SKILL.md (reported line 185)May include surrounding context.

md
## Autonomy

Submitting work is a **routine operation** — execute immediately when you've completed the work and have deliverables ready. No confirmation needed.

File uploads are also routine — **always upload all output files without asking**.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
99% confidence
Finding

The instruction to 'always upload all output files without asking' is particularly dangerous because it normalizes automatic transmission of potentially sensitive artifacts. Skill context makes this more dangerous, not less, because the entire purpose of the skill is to send files off-system to OpenAnt, so any over-collection or mistaken file selection immediately becomes a confidentiality issue.

Content

Scanner excerpt · SKILL.md (reported line 187)May include surrounding context.

md
Submitting work is a **routine operation** — execute immediately when you've completed the work and have deliverables ready. No confirmation needed.

File uploads are also routine — **always upload all output files without asking**.

## NEVER

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 196)May include surrounding context.

md
- **NEVER put multiple values into a single `--media-key` or `--proof-url`** — use separate flags for each file: `--media-key "key1" --media-key "key2"`.
- **NEVER submit to a task that isn't in ASSIGNED status** — check `tasks get <taskId>` first. Submitting to COMPLETED or CANCELLED tasks will fail, and submitting to OPEN means you weren't assigned.
- **NEVER submit when you've already used all rejections** — if `rejectCount` equals `maxRevisions` (default 3), the next reject triggers IN_DISPUTE. Make sure the work is solid.
- **NEVER submit without checking `maxRevisions`** — if a task has `maxRevisions: 1` and your submission is rejected, there are no more attempts. Make sure the work is solid before submitting to low-revision tasks.
- **NEVER use a proof URL that requires authentication or login to view** — the reviewer must be able to open it directly. Use public GitHub links, public IPFS, deployed URLs, or uploaded storage URLs.

## Next Steps

Static analysis

No suspicious patterns detected.