ClawHub
Back to skill

Security audit

eightctl

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly coherent for controlling an Eight Sleep device, but it installs a mutable third-party CLI that will handle account credentials and device control.

Review the upstream eightctl project before installing and prefer a pinned version if available. Only provide Eight Sleep credentials in the expected config or environment, and confirm any command that changes temperature, alarms, schedules, audio, or base angle.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:13
Finding
Unpinned Third-Party CLI Dependency<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 13-18 **Vulnerability Type**: Unpinned third-party dependency resolved from a mutable upstream source **Risk Level**: Medium ### Vulnerable Code ```yaml { "id": "go", "kind": "go", "module": "github.com/steipete/eightctl/cmd/eightctl@latest", "bins": ["eightctl"], "label": "Install eightctl (go)", ``` ### Technical Analysis The installation configuration retrieves `github.com/steipete/eightctl/cmd/eightctl@latest`. The `@latest` selector is mutable and does not identify a specific reviewed release or commit. Consequently, the code installed in the future may differ from the code that was available when this Skill was audited. The project does not specify an immutable version, commit hash, or other explicit integrity boundary for this dependency. If the upstream repository, maintainer account, module publication process, or a future release is compromised, users may install a malicious version without any change to this Skill file. This is a supply-chain risk rather than evidence that the currently referenced upstream project is malicious. ### Attack Path 1. An attacker compromises the upstream repository, a maintainer account, or its release process. 2. The attacker publishes a malicious version that becomes the version resolved by `@latest`. 3. The Skill installer retrieves and builds that mutable version. 4. The resulting `eightctl` executable is installed under the expected legitimate command name. 5. When the user or agent invokes `eightctl`, the malicious executable runs with that process's privileges. 6. The executable may access resources available to the user, including Eight Sleep credentials supplied through `EIGHTCTL_EMAIL`, `EIGHTCTL_PASSWORD`, or `~/.config/eightctl/config.yaml`. ### Impact Assessment Successful exploitation could permit arbitrary code execution with the privileges of th ...[truncated 315 chars]
Remediation
<![CDATA[ ## Remediation Suggestions - Replace `@latest` with a specific, reviewed semantic version or immutable commit. - Verify that the pinned module version is covered by Go module checksum validation. - Review dependency source changes before deliberately updating the pinned version. - Use an automated dependency update process that creates reviewable changes rather than resolving new code silently during installation. - Where practical, publish and verify signed release artifacts or provenance metadata. - Run the CLI with least privilege and limit exposure of authentication environment variables to the processes that require them. ]]>

SkillSpector

Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Description-Behavior Mismatch

Low
Confidence
91% confidence
Finding
The manifest says the skill controls Eight Sleep pods for status, temperature, alarms, and schedules, which implies a limited set of pod-related functions. However, the documentation also advertises audio controls and adjustable base controls, which extend beyond the manifest's stated scope.

Static analysis

No suspicious patterns detected.