ClawHub
Back to skill

Security audit

Admapix 1.0.13

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed AdMapix ad-search integration that sends user-confirmed search parameters to the AdMapix API and returns a generated results page.

Before installing, prefer a pinned and trusted ClawHub installer version if available, and only configure an AdMapix API key you are comfortable using for this service. Search terms, regions, dates, and other filters will be sent to AdMapix to generate the results page.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
README.md:15
Finding

Unpinned Third-Party Package Execution During Installation

Content
View full analysis

Vulnerability Details

File Locations: README.md:15, README_CN.md:15
Vulnerability Type: Unpinned package execution through npx
Risk Level: Medium

Complete Code Snippet:

bash
npx clawhub install admapix

Technical Analysis

The documented installation command invokes the clawhub package through npx without specifying a reviewed version or integrity constraint. Depending on the local npm configuration and cache state, npx can retrieve the current package release from the configured registry and execute its command-line entry point.

The effective installer implementation is not included in this project, so it was outside the reviewed artifact and may change after this Skill version has been audited. This creates a supply-chain trust boundary in which an upstream package compromise, registry-account takeover, malicious replacement, or unexpectedly unsafe future release could introduce executable behavior.

The audit did not establish that the current clawhub package is malicious. The confirmed issue is that the installation instructions do not constrain users to a specific reviewed release.

Attack Path

  1. An attacker compromises the package publisher, registry account, distribution channel, or a future upstream clawhub release.
  2. The attacker publishes a modified package version containing malicious lifecycle or command-line code.
  3. A user follows the documented npx clawhub install admapix command.
  4. npx resolves and downloads the attacker-controlled or compromised package version.
  5. The package executes with the privileges and environment of the user running the installation command.
  6. The malicious package can access resources available to that process, including user files, environment variables, network access, and writable configuration locations.

Impact Assessment

Successful exploitation could obtain the same effective privileges as the user running `n ...[truncated 674 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin clawhub to a specific version that has been reviewed, rather than allowing unconstrained resolution of the latest release.
  2. Publish the expected package version and registry source explicitly in both installation guides.
  3. Where supported, verify the downloaded package against a documented integrity hash or signed provenance record.
  4. Use a lockfile or equivalent immutable dependency mechanism for automated installation and CI environments.
  5. Configure trusted registry scopes and prevent fallback to untrusted or unexpected package registries.
  6. Review new clawhub versions before updating the pinned version, including command entry points and lifecycle scripts.
  7. Run installation under a non-privileged account with minimal filesystem access and without unrelated secrets in the environment.
  8. Apply the same corrected command to both README.md and README_CN.md so localized documentation does not retain the unsafe installation path.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (10)

Direct Prompt Extraction

High
Category
System Prompt Leakage
Confidence
85% confidence
Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · SKILL.md (reported line 194)May include surrounding context.

}

text

## Output Guidelines

1. **Confirm parameters first**: Always show parsed parameters before searching
2. **All links in Markdown format**: `[text](url)`

Rp1

Medium
Category
MCP Rug Pull
Confidence
91% confidence
Finding

The README instructs users to run npx clawhub install admapix without pinning a specific version of the package. This causes execution of whatever package version is current at install time, which creates a supply-chain risk if the package is compromised, updated maliciously, or changed in a breaking way. In the context of an AI agent skill installer, this is more dangerous because users are being told to execute remote code directly from the registry.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
92% confidence
Finding

The README instructs users to install and execute a package via npx clawhub without pinning an exact version. This creates a supply-chain risk because the command may fetch and run whatever package version is current at install time, including a compromised or malicious release.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 17)May include surrounding context.

md
**Fetch data by calling the AdMapix API via curl.**

API endpoint: `https://api.admapix.com/api/data/search`
Authentication: Header `X-API-Key: $ADMAPIX_API_KEY` (environment variable, managed by the platform)

### Request Format

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 25)May include surrounding context.

md
**Fetch data by calling the AdMapix API via curl.**

API endpoint: `https://api.admapix.com/api/data/search`
Authentication: Header `X-API-Key: $ADMAPIX_API_KEY` (environment variable, managed by the platform)

### Request Format

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 137)May include surrounding context.

md
**Fetch data by calling the AdMapix API via curl.**

API endpoint: `https://api.admapix.com/api/data/search`
Authentication: Header `X-API-Key: $ADMAPIX_API_KEY` (environment variable, managed by the platform)

### Request Format

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 25)May include surrounding context.

POST JSON, example:

bash
curl -s -X POST "https://api.admapix.com/api/data/search" \
  -H "X-API-Key: $ADMAPIX_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"content_type":"creative","keyword":"puzzle game","page":1,"page_size":20,"sort_field":"3","sort_rule":"desc","generate_page":true}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 124)May include surrounding context.

md
**If set**, continue to the next step.

### Step 5: Build and Execute curl Command

After user confirmation, build the JSON body and call the API via curl.

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 189)May include surrounding context.

"findCntSum": 3, "impression": 123456, "showCnt": 5, "appList": [{"name": "App", "pkg": "com.xxx", "logo": "https://..."}] }] }

text

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
94% confidence
Finding

Lines L147-L156 require that the result message contain only the fixed short message plus the H5 link and explicitly forbid appending any text-format result list. However, L197-L199 instruct the skill to use Markdown links, end each output with next-step hints, and humanize impression numbers, which contradicts the earlier 'only send' requirement for search results.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.