Skill Search & Create

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 1:11 AM UTC
• Version: 1.1.0

Overview

This skill is a straightforward ClawHub search/create helper, with expected CLI installation and publishing instructions but some disclosure and dependency-pinning caveats.

Before installing or using this skill, confirm you trust the `clawhub` npm package source, review generated skill files before publishing, and treat `clawhub publish` as an external upload that may expose code and metadata.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:14

Finding

Unpinned ClawHub npm Dependency Creates a Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 14–19
Vulnerability Type: Unpinned third-party npm dependency
Risk Level: Medium

Vulnerable Code

yaml

install:
  - id: node
    kind: node
    package: clawhub
    bins: ["clawhub"]
    label: "Install ClawHub CLI (npm)"

Technical Analysis

The installation configuration identifies the npm package clawhub without specifying an exact version or integrity constraint. Consequently, installation may resolve to whichever package release is current at that time rather than the version reviewed alongside this skill.

This creates a supply-chain exposure: if a future package version is compromised, maliciously maintained, or otherwise unsafe, installing the skill could introduce unreviewed code. npm packages may execute lifecycle scripts during installation, and the resulting clawhub executable runs when the skill performs search, creation, login, or publishing operations.

No evidence establishes that the current clawhub package is malicious. The confirmed issue is the absence of dependency version and integrity controls.

Attack Path

1. An attacker compromises the npm package, its maintainer account, or a future release process.
2. The attacker publishes a malicious version under the expected clawhub package name.
3. The skill installation mechanism resolves the unpinned dependency to that malicious release.
4. Malicious code executes through an npm installation lifecycle script or when the installed clawhub binary is invoked.
5. The code operates with the permissions and environmental access of the user or agent running the installation or command.

Impact Assessment

Successful exploitation could permit arbitrary code execution with the installing user's privileges. Depending on the execution environment, exposed resources could include project files, environment variables, authentication material accessible to th ...[truncated 365 chars]

Remediation

View remediation

Remediation Suggestions

• Pin clawhub to an exact, reviewed version rather than allowing resolution to an arbitrary current release.
• Use lockfile or integrity metadata, where supported by the skill installation system, to verify the expected package artifact.
• Restrict installation to the official npm registry and verify the package publisher and provenance.
• Review package lifecycle scripts and release changes before upgrading the pinned version.
• Perform installation and CLI execution in a sandbox or least-privileged environment with access only to required files and credentials.
• Disable npm lifecycle scripts during installation when they are unnecessary and the surrounding framework supports doing so.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill explicitly instructs users to publish a skill to ClawHub and notes login is required, but it does not warn that this performs an external network action and may publicly release code, metadata, or other content. In an agent setting, this increases the risk of unintended data exfiltration or accidental public disclosure if the agent prepares and publishes a skill without clear user understanding and explicit confirmation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

The file presents substantial user-facing instructions in Chinese, including the description, feature list, workflow, and examples, while also mixing English headings. This can amount to a language/locale policy issue because the skill does not state that it is Chinese-only, region-specific, or that users may choose another language.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.