ClawHub
Back to skill

Security audit

Hive Intelligence Publisher

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent guide for publishing blockchain-attested intelligence, with important but disclosed risks around permanent public posts, wallet handling, network calls, and npm dependencies.

Install and run this only in a workspace without unrelated secrets, review the npm packages you install, store any wallet mnemonic securely, and assume anything published through the skill is public, permanent, and not suitable for private or sensitive information.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:12
Finding

Unpinned Third-Party Executable Dependencies

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 12
Vulnerability Type: Insecure third-party dependency installation
Risk Level: Medium

Vulnerable Code:

bash
npm install @kynesyslabs/demosdk@^2.11.0 tsx

Technical Analysis

The installation instruction does not provide reproducible dependency resolution. The caret constraint on @kynesyslabs/demosdk@^2.11.0 permits npm to install later compatible releases, while tsx has no version constraint at all. The project also provides no lockfile, package integrity values, vendored source, or other mechanism for ensuring that users execute the same dependencies that were reviewed.

npm packages can run lifecycle scripts during installation and execute application code later when imported. Consequently, a compromised package release, malicious transitive dependency, or unexpectedly changed future version could execute code with the privileges of the user following the Quick Start instructions.

Attack Path

  1. An attacker compromises the npm account, publication process, repository, or transitive dependency of an allowed package.
  2. The attacker publishes a malicious version that satisfies ^2.11.0, or compromises a version selected through the unconstrained tsx dependency.
  3. A user follows the documented Quick Start command.
  4. npm resolves and downloads the altered dependency because no reviewed lockfile or exact version prevents the selection.
  5. Attacker-controlled code executes through an npm lifecycle hook or when the dependency is imported and used.
  6. The code operates with the installing user's permissions and can access data available to that process.

Impact Assessment

Successful exploitation could provide arbitrary code execution under the local user's account. The exposed scope may include project files, environment variables, network credentials, and the wallet mnemonic created or used by the documented workflow. Compr ...[truncated 370 chars]

Remediation
View remediation

Remediation Suggestions

  • Pin every direct dependency to an exact, reviewed version rather than using caret ranges or unconstrained package names.
  • Add and review a package manifest and lockfile, then instruct users to perform reproducible installation with npm ci.
  • Commit lockfile integrity metadata and review all transitive dependencies before release.
  • Use npm ci --ignore-scripts where package functionality permits it; otherwise, audit every required lifecycle script.
  • Verify package provenance, registry ownership, signatures, and integrity before installation.
  • Run dependency code in a least-privilege environment without unrelated secrets or wallet mnemonics.
  • Keep wallet material outside the project and process environment where possible, and document secure mnemonic storage.
  • Establish automated dependency scanning and a controlled process for reviewing and adopting dependency updates.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill encourages publishing intelligence on-chain and notes permanence later in the document, but the high-level description and quick-start flow do not prominently warn users that submitted content is permanent, public, and difficult or impossible to remove. This can lead users to disclose sensitive, regulated, proprietary, or personal data under the mistaken assumption that posting is routine and reversible.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 27)May include surrounding context.

md
const address = demos.getAddress();

// Fund from faucet (100 DEM free)
await fetch("https://faucetbackend.demos.sh/api/request", {
  method: "POST", headers: { "Content-Type": "application/json" },
  body: JSON.stringify({ address })
});

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 38)May include surrounding context.

typescript
const dahr = await demos.web2.createDahr();
const res = await dahr.startProxy({ url: "https://api.coingecko.com/api/v3/simple/price?ids=bitcoin&vs_currencies=usd", method: "GET" });
const data = JSON.parse(res.data);
const attestation = { url: res.url, responseHash: res.responseHash, txHash: res.txHash, timestamp: Date.now() };