Snippets Sync

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 5:22 AM UTC
• Version: 1.0.1

Overview

This is a straightforward snippets-and-notes sync skill with clear vault scoping; users should still be careful about synced content and the mutable install command.

Use a dedicated vault that contains no secrets, keep backups/versioning for synced notes, and prefer a pinned or verified installer command instead of running a mutable `@latest` package when possible.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: README.md:42

Finding

Unpinned Third-Party Package Execution During Installation

Content

View full analysis

Vulnerability Details

File Location: README.md, lines 42-44
Vulnerability Type: Unpinned package execution and software supply-chain risk
Risk Level: Medium

bash

npx clawhub@latest install snippets-sync

Technical Analysis

The documented installation command instructs npx to obtain and execute the mutable latest release of the third-party clawhub package. The effective code executed by this command can therefore change after the Skill has been reviewed.

No exact package version, lockfile, package integrity hash, or other artifact-verification mechanism is specified. If the package publisher account, package registry, or a future release is compromised, users following the documentation could execute unreviewed attacker-controlled code. The issue is confined to the installation guidance; the audited project itself contains no bundled executable scripts or malicious payloads.

Attack Path

1. An attacker compromises the clawhub publisher account, registry distribution channel, or a future package release.
2. The attacker publishes malicious code as the release resolved by the latest tag.
3. A user follows the installation instructions and runs npx clawhub@latest install snippets-sync.
4. npx downloads and executes the mutable package version.
5. The malicious package runs with the privileges and environment available to the installing user.

Impact Assessment

Successful exploitation could allow arbitrary code execution with the installing user's privileges. Depending on that user's permissions and environment, the malicious package could access user-readable files, environment variables, project data, and network resources or modify user-writable files. This finding does not independently provide administrative privileges; its practical scope is limited by the privileges of the user executing the installation command.

Remediation

View remediation

Remediation Suggestions

• Replace @latest with an exact, reviewed package version.
• Publish and verify the expected package provenance and registry source.
• Use a lockfile or an equivalent immutable dependency-resolution mechanism where supported.
• Verify the downloaded package using a trusted integrity hash or signature before execution.
• Review new package versions before updating the pinned installation command.
• Consider separating package download from execution so users can inspect and verify the artifact before running it.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The install command uses npx clawhub@latest, which pulls and executes the newest package version at install time rather than a reviewed, fixed version. This creates a supply-chain risk: if a malicious or compromised release is published, users may execute untrusted code simply by following the README.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The README encourages bidirectional sync of markdown notes and snippets across machines but does not warn that edits and deletions propagate automatically, potentially exposing sensitive notes or overwriting content on all synced devices. In a skill specifically designed around shared vault syncing, that omission increases the likelihood of accidental data disclosure or loss.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.