n8n

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:30 AM UTC
• Version: 1.0.0

Overview

This skill is not clearly malicious, but it substantially overstates implemented capabilities and has unsafe installation and verification patterns users should review before installing.

Treat this as a review-needed package. Do not rely on its claimed security gates, self-improvement, model fallback, or persistent-agent behavior unless the publisher supplies real implementation code and tests. If installing anyway, review the installer first, avoid latest-based commands, use an isolated environment, pin dependencies, and verify the package identifier and publisher.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T08 · Insecure Dependencies

Error

• Location: install.sh:21
• Finding: Unpinned third-party packages are executed during installation<![CDATA[ ## Vulnerability Details **File Location**: `install.sh:21-23`; related installation instructions at `skill.md:29-31`, `QUICKSTART.md:5-7`, and `README.md:34-36` **Vulnerability Type**: Supply-chain exposure through mutable dependencies **Risk Level**: High ### Vulnerable Code ```bash # Install dependencies echo "📦 Installing dependencies..." pip install -q langgraph openai-agents crewai pydantic-ai mem0 zep-python 2>/dev/null || true ``` The documentation also instructs users to execute a mutable npm package version: ```bash npx clawhub@latest install agentic-ai-gold ``` ### Technical Analysis The installer downloads and executes six Python packages without exact version constraints, a lockfile, or package hashes. The documented `npx clawhub@latest` command similarly executes whichever release is tagged as `latest` at execution time. Python and npm package installations can execute package-controlled installation or build logic. Consequently, the effective code executed during installation can change after this project has been audited. The command also redirects dependency errors to `/dev/null` and uses `|| true`. This suppresses both installation errors and dependency-resolution failures, leaving the environment in an unknown or partially installed state while installation continues. No evidence establishes that the currently named dependencies are malicious. The vulnerability is that their identities and contents are not reproducibly constrained or verified. ### Attack Path 1. An attacker compromises a referenced package, its maintainer account, or the associated package registry. 2. Alternatively, an unsafe or incompatible new release is published under one of the referenced names. 3. A user follows the project documentation or runs `install.sh`. 4. `pip` or `npx` downloads the mutable package release. 5. Package-controlled installation logic executes with the privileges of the user running the installer. 6. Errors can be hidden by `2> ...[truncated 744 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin every Python dependency to an audited exact version. 2. Generate a lockfile and require package hashes, for example through `pip-compile --generate-hashes`. 3. Install dependencies with a command such as: ```bash python3 -m pip install --require-hashes -r requirements.txt ``` 4. Pin the ClawHub CLI to a reviewed exact version instead of using `@latest`. 5. Install Python dependencies in a dedicated virtual environment rather than the user's global environment. 6. Remove `2>/dev/null || true`; terminate installation when dependency installation fails. 7. Verify package origin, ownership, and signatures where the package ecosystem supports them. 8. Run dependency vulnerability and provenance checks in CI before publishing. ]]>

T08 · Insecure Dependencies

Warning

• Location: README.md:34
• Finding: README directs users to a different package identifier<![CDATA[ ## Vulnerability Details **File Location**: `README.md:34-36` **Vulnerability Type**: Package-name inconsistency and unintended package installation **Risk Level**: Medium ### Vulnerable Code ```bash # 1. Install (60 seconds) npx clawhub@latest install agentic-ai ``` The package metadata and other documentation identify the project as `agentic-ai-gold`: ```bash npx clawhub@latest install agentic-ai-gold ``` ### Technical Analysis The primary README instructs users to install `agentic-ai`, while `_meta.json`, `skill.md`, and `QUICKSTART.md` identify the package as `agentic-ai-gold`. Package managers and plugin registries treat distinct identifiers as separate packages. Therefore, following the README can install an unrelated artifact. This resembles a dependency-confusion or package-substitution exposure because users cannot reliably determine that the resolved package is the audited project. There is no evidence in the reviewed files that an attacker currently controls the alternate identifier. The confirmed defect is the inconsistent installation target and resulting possibility of installing unaudited code. ### Attack Path 1. A user treats `README.md` as the authoritative installation guide. 2. The user executes `npx clawhub@latest install agentic-ai`. 3. ClawHub resolves the different `agentic-ai` identifier rather than `agentic-ai-gold`. 4. If that identifier belongs to another publisher, is compromised, or is later claimed by an attacker, its installation logic is executed. 5. The user may incorrectly believe the installed artifact is the audited `agentic-ai-gold` project. ### Impact Assessment The immediate impact is installation of an unintended or unaudited package. If the alternate package is hostile, the impact can include arbitrary code execution with the invoking user's privileges, access to user-readable credentials, source-code modification, and compromise of the local development environment. The exact resulting privilege le ...[truncated 127 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace `agentic-ai` with the canonical `agentic-ai-gold` identifier. 2. Use the same identifier in every installation guide, command, metadata file, and support document. 3. Pin the installer CLI to an audited version instead of `@latest`. 4. Add publisher or owner verification before installation. 5. Add an automated documentation test that extracts installation commands and confirms that all referenced package identifiers match `_meta.json`. 6. If possible, reserve the alternate package identifier to prevent future impersonation and direct users to the canonical package. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: install.sh:29
• Finding: Environment-controlled skill path permits Python command injection<![CDATA[ ## Vulnerability Details **File Location**: `install.sh:29-42` **Vulnerability Type**: Python source injection through unsafe string interpolation **Risk Level**: High ### Vulnerable Code ```bash # Copy skill files SKILL_DIR="${CLAWHUB_SKILL_DIR:-$HOME/clawd/skills/agentic-ai-gold}" mkdir -p "$SKILL_DIR" # Verify installation echo "🔍 Verifying installation..." python3 -c " import sys sys.path.insert(0, '$SKILL_DIR') try: print('✓ Core framework ready') print('✓ 17 dharmic gates active') print('✓ 4-tier fallback operational') print('✓ Shakti Flow: ACTIVE') except Exception as e: print(f'⚠ Warning: {e}') " ``` ### Technical Analysis `CLAWHUB_SKILL_DIR` is controlled by the process environment. Its value is assigned to `SKILL_DIR` and then interpolated directly into a Python program passed to `python3 -c`. Shell quoting around the outer command does not make the resulting Python source safe. A value containing a single quote can terminate the Python string, append Python statements, and comment out the remaining characters. For example, a value conceptually shaped as: ```text x'); __import__('os').system('id'); # ``` causes the generated Python line to become equivalent to: ```python sys.path.insert(0, 'x'); __import__('os').system('id'); #') ``` The injected `os.system` call is then executed during the purported verification stage. This is a source-code injection flaw rather than merely an invalid-path handling issue. ### Attack Path 1. An attacker obtains influence over the environment used to invoke the installer. Possible sources include a wrapper script, CI configuration, inherited shell environment, or malicious installation instructions. 2. The attacker assigns a crafted Python payload to `CLAWHUB_SKILL_DIR`. 3. The victim runs `install.sh`. 4. Bash expands `$SKILL_DIR` into the double-quoted `python3 -c` argument. 5. The crafted single quote escapes the intended Python string literal. 6. Python parses and executes ...[truncated 796 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions Do not interpolate environment-controlled values into Python source code. Pass the path as a positional argument: ```bash python3 - "$SKILL_DIR" <<'PY' import sys skill_dir = sys.argv[1] sys.path.insert(0, skill_dir) # Perform real imports and validation here. PY ``` Alternatively, export a dedicated environment variable and read it using `os.environ`. Additional hardening should include: 1. Validate that the path is absolute and points to an expected directory. 2. Canonicalize it with `realpath` and enforce an allowed base directory where appropriate. 3. Reject control characters such as newlines and null bytes. 4. Avoid constructing executable source strings from shell variables. 5. Add automated tests using quotes, backslashes, newlines, semicolons, and other hostile path characters. 6. Run installation and verification with the minimum required privileges. ]]>

other

Error

• Location: install.sh:33
• Finding: Installer and examples fabricate successful security verification<![CDATA[ ## Vulnerability Details **File Location**: `install.sh:33-42`; related behavior in `examples/hello_agent.py:10-50`, `examples/01_hello_council.py:17-87`, `examples/02_spawn_specialist.py:55-75`, and `examples/03_self_improvement.py:69-151` **Vulnerability Type**: Fabricated security-control and operational verification **Risk Level**: High ### Vulnerable Code The installer reports successful verification without importing or exercising framework code: ```bash # Verify installation echo "🔍 Verifying installation..." python3 -c " import sys sys.path.insert(0, '$SKILL_DIR') try: print('✓ Core framework ready') print('✓ 17 dharmic gates active') print('✓ 4-tier fallback operational') print('✓ Shakti Flow: ACTIVE') except Exception as e: print(f'⚠ Warning: {e}') " ``` The advertised quick-start example similarly prints success without performing validation: ```python # Simulate council activation print("🧬 Activating 4-Member Persistent Council...") print(" ✓ Gnata (Knower) — ACTIVE") print(" ✓ Gneya (Known) — ACTIVE") print(" ✓ Gnan (Knowing) — ACTIVE") print(" ✓ Shakti (Force) — ACTIVE") print() print("🛡️ Checking 17 Dharmic Security Gates...") for gate in ["Ahimsa", "Satya", "Consent", "Reversibility", "Containment"]: print(f" ✓ {gate} — PASS") print(" ... (12 more gates)") print(" ✓ ALL 17 GATES ACTIVE") ``` The self-improvement example generates test outcomes randomly rather than executing tests: ```python passed = 0 for test in tests: success = random.random() > 0.1 # 90% pass rate status = "✅ PASS" if success else "❌ FAIL" if success: passed += 1 print(f" {status} {test}") print(f"\n Results: {passed}/{len(tests)} tests passing") ``` ### Technical Analysis The installer places an unconditional sequence of `print` statements inside a `try` block. It does not import `agentic_ai`, instantiate a council, validate dependencies, exercise fallback providers, test security gates ...[truncated 2566 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove every unconditional success message that is not backed by a concrete assertion. 2. Supply the actual `agentic_ai` implementation or remove claims that the package provides it. 3. Replace installer verification with real imports and fail-closed checks, for example: ```python from agentic_ai import Council council = Council() result = council.self_test() if not result.ok: raise SystemExit(result.details) ``` 4. Verify every advertised subsystem independently: - Dependency availability and compatible versions. - Council creation and lifecycle behavior. - Security-gate enforcement using negative test cases. - Memory persistence and retrieval. - Provider fallback under simulated provider failure. - Containment, consent, rollback, logging, and cleanup behavior. 5. Return a nonzero exit status whenever installation or verification fails. 6. Stop suppressing dependency errors. 7. Clearly label simulation-only examples in filenames, headings, and output. 8. Never present random values as integration-test or research results. 9. Add reproducible automated tests and include the test source in the package. 10. Ensure documentation distinguishes implemented features, demonstrations, planned features, and externally provided integrations. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (19)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The declared description presents a substantive AI framework with self-improvement, security gating, resilience features, and research-backed infrastructure. The supplied code is only an example/demo script with a mock Council class that stores member metadata and prints simulated status and canned responses. References to '17 dharmic gates', '4-tier model fallback', '5-layer memory', and 'self-improvement' are only displayed text, not implemented behavior. Therefore the actual code materially underdelivers on the claimed primary purpose and capabilities.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The declared description presents a sophisticated self-improving AI framework with substantial security, resilience, and research capabilities. The supplied code chunk is only an example script demonstrating simulated specialist-agent creation and execution. Its 'dharmic gates' are printed messages over a short hardcoded list, task execution is mocked via canned strings, and there is no evidence of self-improvement, real infrastructure behavior, resilience layers, or access to any research corpus. This is a material description-to-behavior mismatch, not merely omitted implementation detail.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: There is a material mismatch between the description and the code chunk. The description presents a real self-improving AI infrastructure with substantive capabilities, but the supplied code is explicitly an example/demo that simulates those behaviors. Its primary behavior is printing a narrated mock workflow and storing simple in-memory counters/history. It does not perform real self-modification, external research retrieval, validation, infrastructure control, or command execution. Therefore the declared description overstates what this code actually does.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The declared description presents a substantive self-improving AI framework with security, resilience, and research capabilities. However, the supplied code chunk is only a demonstration script that prints static messages indicating those systems are active. It does not implement self-improvement, security enforcement, fallback logic, memory systems, or agent operations. Because the actual code behavior is primarily cosmetic/demo output rather than the described functionality, this is a material description-to-behavior mismatch.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The declared description presents the skill as an autonomous self-improving AI framework with specific security and resilience properties. The supplied code chunk does not implement those capabilities; it primarily performs environment setup and package installation. While an installer can support such a framework, this chunk's actual purpose is materially different from the declared primary purpose. It also writes to the filesystem and invokes pip, which are concrete behaviors not reflected in the description or permissions. Therefore the description does not accurately represent what this code chunk actually does.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence
• Finding: The quickstart instructs users to execute `npx clawhub@latest install agentic-ai-gold`, which pulls and runs the latest package code at install time without a pinned, reviewed version. This creates a supply-chain risk: if the package or one of its release channels is compromised, users following the quickstart may immediately execute attacker-controlled code on their systems.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence
• Finding: The README instructs users to run `npx clawhub@latest install agentic-ai`, which pulls and executes the latest remote package version without pinning. This creates a supply-chain risk: if the package is compromised or a malicious update is published, users may execute attacker-controlled code during installation.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The README explicitly promotes self-rewriting and overnight update behavior but does not warn users that the system may modify code or system state autonomously. In an agent framework, self-updating behavior materially increases the risk of unauthorized changes, persistence of bad logic, and difficult-to-audit compromise paths if the update pipeline is poisoned or misaligned.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The README advertises native access to 10,000+ MCP servers and broad agent-to-agent connectivity while emphasizing seamless integration, but it omits clear warnings about data exposure, tool trust, and host-system integrity. In this context, encouraging broad external tool access without caution can lead users to over-trust remote servers that may exfiltrate secrets, manipulate agent behavior, or trigger unsafe actions.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The example states that agents terminate after task completion, but every Specialist instance is appended to the class-level _registry and never removed. In a long-running process or if this pattern is copied into production code, completed agents and their task metadata will accumulate indefinitely, causing memory growth and potentially retaining sensitive task information longer than intended.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The docstrings describe overnight research, evaluation, and self-updating behavior, but the code only simulates these phases locally and records fabricated results. This mismatch is dangerous because developers may rely on nonexistent safeguards such as integration testing, dharmic validation, or approval gates, creating false assurance around an agentic system that is marketed as self-improving.

Intent-Code Divergence

Medium

• Confidence: 98% confidence
• Finding: The example explicitly claims 'This is not metaphorical. It's operational.' even though the implementation only prints simulated activity driven by random values and does not perform real research, testing, or self-modification. In a security-sensitive agent framework, overstating autonomous capability can mislead users into enabling or trusting workflows they believe are validated or improving themselves, weakening informed consent and safe deployment decisions.

Session Persistence

Medium

• Category: Rogue Agent

Content

echo "📦 Installing dependencies..."
pip install -q langgraph openai-agents crewai pydantic-ai mem0 zep-python 2>/dev/null || true

# Create config directory
mkdir -p ~/.agentic_ai/config

# Copy skill files

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence
• Finding: The skill instructs users to execute `npx clawhub@latest install agentic-ai-gold`, which fetches and runs the latest remote package version without pinning or integrity verification. This creates a supply-chain execution risk: if the package or publishing account is compromised, users may run attacker-controlled code immediately during installation.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The skill explicitly markets autonomous nightly scanning, testing, update proposal, and self-evolution without clear safety boundaries, approval requirements, or warnings about code and system changes. In an agent framework context, unattended self-modification can alter behavior, permissions, dependencies, and data handling in ways that increase the blast radius of mistakes or compromise.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The usage example shows `enable_auto_evolution()` as a straightforward feature toggle and states 'Skill now improves itself' without any warning, approval gate, or constraint language. This normalizes autonomous modification as a default-safe action, increasing the likelihood that operators enable persistent self-changing behavior without understanding effects on code integrity, data safety, or connected services.

Natural-Language Policy Violations

Low

• Confidence: 89% confidence
• Finding: The example output uses explicitly religious/cultural framing ('Dharmic Security Gates' and related terminology) without any indication that the user opted into that framing. While this is not a code-execution or data-security issue, it can create exclusion, misrepresentation, or trust concerns by presenting a value-laden worldview as a default security model.

Missing User Warnings

Low

• Confidence: 92% confidence
• Finding: This shell script performs a network-backed `pip install` that modifies the user's Python environment, but it only prints a generic 'Installing dependencies...' message and does not disclose what packages are being fetched or that the command changes the local environment. For a code file, this is a safety-relevant operation and the current messaging is too minimal to count as a clear user warning.

Missing User Warnings

Low

• Confidence: 81% confidence
• Finding: The script creates `~/.agentic_ai/config` and a skill directory under the user's home directory, which are file-system modifications. While the actions are visible in code, there is no explicit user-facing disclosure that installation will create directories in the user's home path.

Static analysis

No suspicious patterns detected.