ClawHub
Back to skill

Security audit

Innovation Catalyst

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly behaves like a local suggestion tool, but its package metadata includes an unnecessary npm dependency flagged as malicious and its Feishu reporting scope is not clearly bounded.

Review this skill before installing. The local script itself appears limited to printing innovation suggestions, but the package dependencies should be cleaned up before npm install, and any Feishu reporting should be explicitly scoped and approved because it may transmit workspace or system-state information externally.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Known Vulnerable Dependency: fs==0.0.1-security — 1 advisory(ies): MAL-2025-21003 (Malicious code in fs (npm))

High
Category
Supply Chain
Confidence
99% confidence
Finding
The lockfile pins the package `fs@0.0.1-security`, and the provided advisory identifies it as a malicious npm package. A malicious dependency in the supply chain can execute attacker-controlled code during install or runtime, potentially leading to credential theft, file tampering, or arbitrary code execution in environments that build or run this skill.

Known Vulnerable Dependency: fs==0.0.1-security — 1 advisory(ies): MAL-2025-21003 (Malicious code in fs (npm))

High
Category
Supply Chain
Confidence
99% confidence
Finding
The dependency list includes fs==0.0.1-security, which the static analysis identifies as having a malicious-code advisory (MAL-2025-21003). Declaring a known malicious npm package is dangerous because package installation or execution can introduce attacker-controlled code into the environment, potentially enabling code execution, data access, or further compromise. In this skill context, the package is not necessary because Node.js already provides a built-in fs module, which makes the inclusion more suspicious rather than justified.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The skill explicitly states it sends a rich Feishu card report and also describes analyzing system state, memory, tools, and events. Without any warning, consent, scoping, or data-minimization language, this creates a real risk of exfiltrating potentially sensitive system-derived information to an external service. In this context, the danger is elevated because the inputs are broad internal state sources rather than narrowly defined user-provided content.