ClawHub
Back to skill

Security audit

Content Distribution

Security checks for vulnerabilities and agentic risk

Overview

This skill has a clear publishing purpose, but its setup runs an unpinned external npm MCP server that can change after review and will handle posting credentials.

Review before installing. Pin the MCP package version if possible, run it with only the platform credentials you intend to use, avoid putting private or secret content in posts, and confirm every target platform and scheduled post before allowing publication.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:67
Finding

Unpinned npm Package Is Automatically Downloaded and Executed

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 67–85
Vulnerability Type: Unpinned third-party dependency execution
Risk Level: Medium

The documented configurations execute the MCP server through npx -y without pinning the npm package to an audited version:

json
**Claude Code** (`.claude/mcp.json`):
{
  "mcpServers": {
    "content-distribution": {
      "command": "npx",
      "args": ["-y", "@automatelab/content-distribution-mcp"]
    }
  }
}
json
**Claude Desktop** (`claude_desktop_config.json`):
{
  "mcpServers": {
    "content-distribution": {
      "command": "npx",
      "args": ["-y", "@automatelab/content-distribution-mcp"]
    }
  }
}

Technical Analysis

The package reference @automatelab/content-distribution-mcp has no exact version or integrity constraint. Consequently, npm resolves the package version at execution time. The -y option suppresses the interactive installation confirmation, allowing the resolved package to be downloaded and executed automatically.

This project contains only SKILL.md; the referenced MCP server implementation is not bundled in the audited artifact. Its executable code and future releases therefore cannot be verified by this audit. If the npm package, publisher account, release process, or registry resolution path is compromised, a subsequently published package version could execute attacker-controlled code when the MCP server starts.

Attack Path

  1. An attacker compromises the npm publisher account, package release pipeline, or another relevant supply-chain component.
  2. The attacker publishes a malicious version of @automatelab/content-distribution-mcp.
  3. A user starts an MCP client using the documented configuration.
  4. npx -y resolves and downloads the currently available package without requiring confirmation.
  5. The malicious package executes with the permissions and environment of the ...[truncated 984 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin the MCP server to a specific, reviewed version, for example:
    json
    "args": ["-y", "@automatelab/content-distribution-mcp@2.2.1"]
  2. Prefer installing the dependency through a committed lockfile that records exact transitive dependency versions and integrity hashes.
  3. Verify package provenance, npm signatures or attestations, publisher identity, and integrity before installation.
  4. Remove -y where practical so unexpected installation or version-resolution events require explicit approval.
  5. Run the MCP server with least privilege in a restricted environment or container, exposing only the credentials and filesystem paths required for content distribution.
  6. Provide platform-scoped credentials with the minimum necessary permissions and rotate them if dependency compromise is suspected.
  7. Establish an explicit update process in which new package versions are reviewed, tested, and approved before the pinned version is changed.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

MCP Config Access

High
Category
Agent Snooping
Confidence
95% confidence
Finding

Skill accesses MCP server configuration files (mcp.json). MCP configs contain server URLs, authentication tokens, and tool definitions — reading them allows the skill to discover and potentially abuse other tool integrations.

Content

Scanner excerpt · SKILL.md (reported line 71)May include surrounding context.

Server setup

Claude Code (.claude/mcp.json):

json
{
  "mcpServers": {

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The skill description encourages multi-platform publishing but does not warn that user-supplied content will be transmitted to external third-party services under the user's configured accounts. This can lead to unintended disclosure of sensitive or internal content and can surprise users about the scope of account activity triggered by the skill.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
82% confidence
Finding

The setup instructions mention platform API keys but provide no security guidance on storing, scoping, or limiting those credentials to only intended platforms. This increases the chance of overbroad credential configuration, accidental misuse of production accounts, or exposure through unsafe environment handling.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.