ClawHub
Back to skill

Security audit

BYOCB ArbInjectionSkill

Security checks for vulnerabilities and agentic risk

Overview

The skill is a disclosed blockchain vulnerability monitor, but it asks users to run unreviewed code from a mutable GitHub repo, install npm dependencies, and schedule daily updates in the main agent session.

Review this skill carefully before installing. Only run it in a constrained environment, pin and inspect the GitHub repository before npm install, avoid automatic daily updates, and configure messaging alerts only after confirming the destination and deciding how much vulnerability detail should be sent externally.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (3)

T06 · System Persistence

Error
Location
SKILL.md:109
Finding

Persistent Scheduled Update and Installation Task

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:109-125
Vulnerability Type: Persistent scheduled execution
Risk Level: High

Vulnerable Code

markdown
## Maintenance

**Daily update required.** Detection patterns and fixes are pushed frequently.

```bash
cd /path/to/arb-injection
git pull origin main
npm install  # If package.json changed

Schedule daily update check (09:00):

json
{
  "schedule": { "kind": "cron", "expr": "0 9 * * *" },
  "payload": { "kind": "systemEvent", "text": "ArbInjectionSkill daily update: git pull and npm install" },
  "sessionTarget": "main"
}
text

### Technical Analysis

The skill requires a recurring cron-like task directed at the main session. The task persists beyond the original skill invocation and repeatedly requests retrieval and installation of code from a mutable remote branch.

Although the scheduled payload is expressed as a system event rather than a directly embedded shell command, its explicit purpose is to trigger `git pull` and `npm install`. If the agent follows the event automatically or with insufficient review, new upstream code and package lifecycle scripts can execute in later sessions without being covered by the original audit.

### Attack Path

1. A user loads the skill and follows its maintenance instructions.
2. The daily schedule is registered against the main agent session.
3. An upstream maintainer, compromised account, or repository attacker modifies the `main` branch or its dependencies.
4. The scheduled event prompts the agent to run `git pull origin main`.
5. The agent runs `npm install`, potentially executing newly introduced package lifecycle scripts.
6. The modified code gains execution in the environment during a later session.

### Impact Assessment

The mechanism establishes cross-session persistence at the agent-task level. Code subsequently introduced upstream may execute with the permissions of 
...[truncated 354 chars]
Remediation
View remediation

Remediation Suggestions

  • Remove the requirement to create an automatic recurring update task.
  • Require explicit, informed user authorization for each update.
  • Pin the repository to a reviewed commit hash rather than tracking main.
  • Present and review upstream diffs before installing or running updated code.
  • Run updates in an isolated, least-privileged environment without unnecessary secrets.
  • Do not target the main agent session with maintenance events.
  • Require signed commits or releases and verify signatures before updating.
  • Maintain an auditable update log and provide a clear mechanism to disable or remove scheduled tasks.

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:16
Finding

Execution of Code Retrieved from a Mutable Remote Repository

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:16-24
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Vulnerable Code

markdown
## Install

```bash
git clone https://github.com/BringYourOwnBot/arb-injection.git
cd arb-injection
npm install

Running the Monitor

text

The same repository is later updated through:

```bash
cd /path/to/arb-injection
git pull origin main
npm install  # If package.json changed

Technical Analysis

The audited artifact contains only documentation and does not include the scanner implementation. Its functional payload is fetched from an external Git repository and subsequently installed and executed. No commit hash, release digest, signature, or other immutable reference is specified.

Consequently, the effective code executed by the skill can differ from the code available when SKILL.md was reviewed. Moreover, npm install can execute package lifecycle hooks such as preinstall, install, and postinstall, creating an execution path before the monitor itself is started.

Attack Path

  1. The user follows the installation instructions and clones the external repository.
  2. Git resolves the repository's current default branch rather than an audited immutable revision.
  3. An attacker who controls or compromises the repository, maintainer account, release process, or referenced dependencies introduces malicious code.
  4. The user runs npm install.
  5. Malicious lifecycle scripts or installed application code execute with the invoking user's permissions.
  6. Subsequent execution of node index.js provides another path for the remotely supplied payload to run.
  7. Daily pulls can replace previously benign code with a malicious version after installation.

Impact Assessment

Successful exploitation can provide arbitrary code execution with the permissions of the account running the installation or monito ...[truncated 321 chars]

Remediation
View remediation

Remediation Suggestions

  • Include the complete, reviewable implementation in the skill package where feasible.
  • Pin clones and updates to an audited full commit hash or signed release.
  • Verify release signatures and cryptographic checksums before installation.
  • Prohibit automatic tracking of a mutable branch such as main.
  • Review repository differences before executing updated code.
  • Execute the scanner in a sandbox or container with minimal filesystem, network, environment, and messaging access.
  • Separate downloading, verification, dependency installation, and execution into independently approved steps.
  • Use npm install --ignore-scripts unless lifecycle scripts have been individually reviewed and are strictly necessary.

T08 · Insecure Dependencies

Error
Location
SKILL.md:18
Finding

Unverifiable Third-Party Dependency Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:18-22
Vulnerability Type: Unsafe third-party dependency installation
Risk Level: High

Vulnerable Code

bash
git clone https://github.com/BringYourOwnBot/arb-injection.git
cd arb-injection
npm install

The installation is also repeated after updates:

bash
cd /path/to/arb-injection
git pull origin main
npm install  # If package.json changed

Technical Analysis

The audited project contains no package.json, lockfile, dependency inventory, version constraints, or integrity metadata. The instruction to run npm install therefore installs a dependency graph that cannot be assessed from the submitted artifact.

Dependency resolution may change over time, and npm lifecycle hooks may execute code during installation. This exposes the environment to upstream package compromise, compromised transitive dependencies, malicious lifecycle scripts, and non-reproducible dependency resolution. The available evidence does not identify a specific malicious npm package, but the installation process is unverifiable and unsafe from an audit perspective.

Attack Path

  1. The user clones the external project and invokes npm install.
  2. npm reads manifests supplied by the mutable external repository.
  3. npm resolves direct and transitive packages not represented in the audited artifact.
  4. A compromised package, newly altered dependency version, or malicious lifecycle script is downloaded.
  5. npm executes applicable installation hooks with the invoking user's permissions.
  6. The dependency can affect the scanner at runtime or perform actions immediately during installation.
  7. Repeated installations after daily updates create recurring opportunities for supply-chain compromise.

Impact Assessment

A malicious dependency or lifecycle hook can execute commands with the installer account's permissions. Potential scope includes accessible ...[truncated 292 chars]

Remediation
View remediation

Remediation Suggestions

  • Include the dependency manifests and lockfile in the audited project.
  • Pin all direct and transitive dependencies to reviewed versions with integrity hashes.
  • Use reproducible installation commands such as npm ci with a committed lockfile.
  • Review dependency provenance, maintainers, lifecycle scripts, and known vulnerability reports.
  • Disable lifecycle scripts using --ignore-scripts unless they are explicitly required and audited.
  • Use an approved package registry and enforce package allowlists where possible.
  • Generate and review a software bill of materials.
  • Scan dependencies continuously, but require manual review before accepting version changes.
  • Perform installation and execution in a least-privileged sandbox without unrelated credentials.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill explicitly instructs the agent to notify users through external messaging channels such as Telegram, WhatsApp, Signal, or Discord, but it does not warn about the sensitivity of vulnerability details being transmitted over third-party services. This creates a real privacy and security risk because contract addresses, vulnerability status, and timing information may be sent to external platforms without user consent, channel verification, or data-minimization controls.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.