ClawHub
Back to skill

Security audit

Clawhub Skill

Security checks for vulnerabilities and agentic risk

Overview

This is a straightforward claim-verification API skill, but users should review it because it sends claim text to an external service and advertises an unpinned global MCP install.

Use the direct HTTPS API only with claims you are comfortable sending to a third-party service. Avoid secrets, personal data, confidential business facts, and regulated information unless the provider's privacy and retention terms are acceptable. Treat the global MCP install as higher risk: review the npm package, pin a version, prefer a local install, and avoid elevated privileges.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:80
Finding

Unpinned Global Installation of a Third-Party npm Package

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:80
Vulnerability Type: Unpinned third-party dependency installed globally
Risk Level: Medium

Vulnerable Code

markdown
- MCP server: `npm install -g @636865636b73756d/mcp-v1`

Technical Analysis

The documentation directs users to globally install the mutable latest release of the third-party npm package @636865636b73756d/mcp-v1. It does not specify an exact reviewed version, integrity hash, lockfile, provenance verification, or lifecycle-script restrictions.

npm packages can execute lifecycle scripts during installation. Consequently, compromise of the package, its publisher account, or its dependency chain could cause attacker-controlled code to execute when a user follows this instruction. The global -g installation also creates broader and more persistent system modifications than are necessary to use the separately documented HTTPS API.

This finding concerns the unsafe dependency-installation instruction. The audited project does not itself contain the npm package or evidence proving that its current contents are malicious.

Attack Path

  1. An attacker compromises the npm publisher account, package release process, or a transitive dependency.
  2. The attacker publishes a malicious release under the package name or introduces a malicious installation hook.
  3. A user follows the documented npm install -g command.
  4. npm resolves the unpinned package to the attacker-controlled release.
  5. Malicious lifecycle code executes with the invoking user's privileges.
  6. The package may install globally accessible files that remain available after the installation command completes.

Impact Assessment

Successful exploitation could run arbitrary code with the privileges of the account executing npm. Potential effects include reading or modifying files accessible to that account, accessing environment variables or developer credentials, ma ...[truncated 327 chars]

Remediation
View remediation

Remediation Suggestions

  • Replace the mutable package reference with an exact, reviewed version rather than relying on the latest release.
  • Publish and verify package provenance and integrity information.
  • Maintain the dependency in a project lockfile where practical.
  • Prefer a local, least-privilege installation over npm install -g.
  • Disable npm lifecycle scripts with --ignore-scripts when they are not required.
  • Review the package and its transitive dependencies before recommending installation.
  • Document the authoritative npm publisher, source repository, expected package checksum, and update-review process.
  • Prefer direct access to the documented HTTPS API when installation of the MCP package is unnecessary.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill instructs users to submit claims to a third-party live verification service but does not clearly warn that the claim contents will be transmitted off-platform. Claims may contain sensitive, proprietary, or regulated information, so the missing disclosure creates a real privacy and data-handling risk even if the service is functioning as described.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
94% confidence
Finding

The skill explicitly posts user-supplied claim text to an external domain, creating a direct exfiltration path for any sensitive data embedded in the claim. This is more concerning because the service is live, unauthenticated for the free tier, and presented as easy to use, which increases the chance that agents or users send confidential material without adequate scrutiny.

Content

Scanner excerpt · SKILL.md (reported line 21)May include surrounding context.

Send a POST request to verify a claim:

bash
curl -X POST https://636865636b73756d.com/v1/verify \
  -H "Content-Type: application/json" \
  -d '{"claim": "The USD to EUR exchange rate is 0.92"}'

Unbounded Resource Access

Medium
Category
Excessive Agency
Confidence
80% confidence
Finding

Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.

Content

Scanner excerpt · SKILL.md (reported line 74)May include surrounding context.

md
## Pricing

- Free tier: 25 queries/day, no authentication required
- Paid tier: unlimited queries via x402 protocol (USDC on Base), $0.001/query

## Agent Discovery

Static analysis

No suspicious patterns detected.