Gougoubi Pump Lifecycle

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:08 AM UTC
• Version: 1.0.0

Overview

This is a disclosed blockchain market operator, but its irreversible wallet actions, inconsistent creator-fee instructions, and unpinned installer should be reviewed before use.

Review this skill carefully before installing. Use it only with a wallet and environment prepared for on-chain transactions, verify every transaction preview before signing, and treat any instruction to call harvestFees as inconsistent with the detailed CLAIM section unless the contract ABI independently confirms it. Prefer a pinned, reviewed installer version and avoid running installation where wallet secrets or production credentials are exposed.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:14

Finding

Unpinned Package Execution in Installation Command

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:14
Vulnerability Type: T08: Insecure Dependencies
Risk Level: High

Vulnerable Code

yaml

installCommand: npx clawhub install gougoubi-pump-lifecycle

Technical Analysis

The installation command invokes clawhub through npx without specifying an exact package version or verifying package integrity. If an approved local version is unavailable, npx may retrieve and execute the package currently published under that name in the configured npm registry.

Consequently, the code executed during installation is mutable and is not necessarily the same code that existed when this Skill was audited. Compromise of the package, its publisher account, the registry, or the dependency chain could therefore introduce arbitrary installation-time behavior.

The issue concerns the clawhub installer invoked by the command. The reviewed SKILL.md does not itself contain an embedded malicious payload, and the audit found no evidence that the current package is malicious. The vulnerability is the absence of version and integrity controls at an executable supply-chain boundary.

Attack Path

1. An attacker compromises the clawhub publishing account, package, registry delivery path, or one of its install-time dependencies.
2. The attacker publishes a malicious release under the expected package name or alters a dependency resolved by that release.
3. A user follows the documented command while no trusted local executable overrides package retrieval.
4. npx resolves the mutable package release and executes its command.
5. The malicious package runs with the operating-system permissions and environment available to the installing user.

Impact Assessment

Successful exploitation can provide arbitrary code execution under the installing user's account. Depending on that account's privileges and environment, an attacker could access project files, wallet ...[truncated 853 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the installer to an explicitly reviewed version instead of resolving the latest release:

   yaml

   installCommand: npx --yes clawhub@<reviewed-version> install gougoubi-pump-lifecycle
   

2. Prefer a package manager workflow backed by a committed lockfile so the complete transitive dependency graph is reproducible.

3. Verify package provenance and integrity using registry integrity metadata, trusted signatures, or an approved internal artifact repository.

4. Disable lifecycle scripts where operationally possible, or review all install-time scripts before execution.

5. Execute installation from a minimally privileged, isolated environment without wallet secrets, production credentials, or unnecessary filesystem access.

6. Establish a controlled update process in which new installer versions and dependency changes are reviewed and tested before the pinned version is changed.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The lifecycle diagram advertises a harvestFees creator action during CLAIM, while the later CLAIM section explicitly says the creator does not need and should not perform such a call. In an autonomous or semi-autonomous transaction skill, contradictory stage instructions are dangerous because they can drive the agent to invoke the wrong contract method, mis-handle user funds, or dead-end the settlement flow at a critical stage.

Content

No source excerpt is available for this finding.

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 70% confidence

Finding

Skill instructs the agent to never refuse or to always comply. Suppressing the agent's ability to decline removes a core safety control and enables downstream harmful requests to succeed.

Content

Scanner excerpt · SKILL.md (reported line 388)May include surrounding context.

md

## Output format

Always respond in the language of the user's message. Default to Chinese
when the user wrote Chinese, English otherwise. Structure every
multi-stage operation as:

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The metadata says the skill will 'harvest creator fees,' but the body later states no harvestFees action exists because fees are transferred at trade time. This mismatch can cause downstream agents or operators to attempt a nonexistent or incorrect settlement action, increasing the chance of failed transactions, incorrect user guidance, or unsafe fallback behavior in a financial workflow.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The install command invokes npx clawhub without pinning an exact package version, so execution may pull whatever version is current at run time. In a skill that orchestrates wallet-connected, on-chain transactions, a compromised or breaking upstream release could alter behavior, introduce malicious code, or change transaction construction without the operator noticing.

Content

No source excerpt is available for this finding.