ClawHub
Back to skill

Security audit

Moss

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent Moss documentation skill with disclosed credentials, API calls, and package install guidance; the main risks are normal integration risks, not hidden behavior.

Install only the Moss packages you need, preferably pinned to reviewed versions in a virtual environment or lockfile. Treat MOSS_PROJECT_KEY as a secret, and only upload or sync documents you intend to place in Moss-managed indexes; use delete operations carefully because they can remove indexed data.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:162
Finding

Unpinned Third-Party Package Installation Creates Supply-Chain Risk

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 162–166
Vulnerability Type: Unpinned third-party dependencies
Risk Level: Medium

The Skill recommends installing third-party packages without exact version constraints, lockfiles, cryptographic hashes, or other integrity-verification controls.

markdown
### Package Installation

| Language              | Package           | Install Command               |
| --------------------- | ----------------- | ----------------------------- |
| JavaScript/TypeScript | `@inferedge/moss` | `npm install @inferedge/moss` |
| Python                | `inferedge-moss`  | `pip install inferedge-moss`  |
| Pipecat Integration   | `pipecat-moss`    | `pip install pipecat-moss`    |

Technical Analysis

These commands resolve the package version from the external npm or Python package registry at installation time. Because no exact versions or integrity hashes are specified, the downloaded code can differ from the version reviewed when the Skill was published.

The project contains no vendored dependency source, package manifest, lockfile, or checksum that would permit verification of the effective dependency payload. This creates exposure to compromised publisher accounts, malicious or unexpectedly changed releases, registry compromise, and package ownership changes. The audit found no evidence that the named packages are currently malicious; the vulnerability is the absence of controls ensuring reproducible and verified dependency installation.

Attack Path

  1. An attacker compromises a dependency publisher account, package registry entry, or another component of the package distribution process.
  2. The attacker publishes a malicious release under one of the documented package names.
  3. A user or agent follows the unpinned npm install or pip install instruction.
  4. The package manager resolves and downloads the attacker-controlled release.
  5. Malicious ...[truncated 1122 chars]
Remediation
View remediation

Remediation Suggestions

  1. Replace mutable installation commands with exact, reviewed versions, such as npm install @inferedge/moss@<reviewed-version> and pip install inferedge-moss==<reviewed-version>.
  2. Provide and enforce lockfiles, such as package-lock.json for npm and a hash-locked requirements file generated by a dependency-management tool for Python.
  3. Require integrity verification where supported. For Python, distribute hashes and use pip install --require-hashes; for npm, retain and verify lockfile integrity metadata.
  4. Document the verified publisher identity, official source repository, and package provenance so users can detect dependency confusion or package substitution.
  5. Review dependency updates before changing pinned versions and use automated vulnerability, provenance, and malware scanning.
  6. Install dependencies in an isolated virtual environment or container under a non-privileged account.
  7. Avoid exposing production credentials during package installation, and provide Moss credentials only to the runtime process that requires them.
  8. If optional integrations are not required, omit their installation to minimize the dependency and attack surface.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 153)May include surrounding context.

  • projectId field in the JSON body
bash
curl -X POST "https://service.usemoss.dev/v1/manage" \
  -H "Content-Type: application/json" \
  -H "x-service-version: v1" \
  -H "x-project-key: moss_access_key_xxxxx" \

Static analysis

No suspicious patterns detected.