ClawHub
Back to skill

Security audit

Clawhub Skill

Security checks for vulnerabilities and agentic risk

Overview

This is a straightforward claim-verification API skill, but users should review it because it sends claim text to an external service and advertises an unpinned global MCP install.

Use the direct HTTPS API only with claims you are comfortable sending to a third-party service. Avoid secrets, personal data, confidential business facts, and regulated information unless the provider's privacy and retention terms are acceptable. Treat the global MCP install as higher risk: review the npm package, pin a version, prefer a local install, and avoid elevated privileges.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:80
Finding
Unpinned Global Installation of a Third-Party npm Package## Vulnerability Details **File Location**: `SKILL.md:80` **Vulnerability Type**: Unpinned third-party dependency installed globally **Risk Level**: Medium ### Vulnerable Code ```markdown - MCP server: `npm install -g @636865636b73756d/mcp-v1` ``` ### Technical Analysis The documentation directs users to globally install the mutable latest release of the third-party npm package `@636865636b73756d/mcp-v1`. It does not specify an exact reviewed version, integrity hash, lockfile, provenance verification, or lifecycle-script restrictions. npm packages can execute lifecycle scripts during installation. Consequently, compromise of the package, its publisher account, or its dependency chain could cause attacker-controlled code to execute when a user follows this instruction. The global `-g` installation also creates broader and more persistent system modifications than are necessary to use the separately documented HTTPS API. This finding concerns the unsafe dependency-installation instruction. The audited project does not itself contain the npm package or evidence proving that its current contents are malicious. ### Attack Path 1. An attacker compromises the npm publisher account, package release process, or a transitive dependency. 2. The attacker publishes a malicious release under the package name or introduces a malicious installation hook. 3. A user follows the documented `npm install -g` command. 4. npm resolves the unpinned package to the attacker-controlled release. 5. Malicious lifecycle code executes with the invoking user's privileges. 6. The package may install globally accessible files that remain available after the installation command completes. ### Impact Assessment Successful exploitation could run arbitrary code with the privileges of the account executing npm. Potential effects include reading or modifying files accessible to that account, accessing environment variables or developer credentials, ma ...[truncated 327 chars]
Remediation
## Remediation Suggestions - Replace the mutable package reference with an exact, reviewed version rather than relying on the latest release. - Publish and verify package provenance and integrity information. - Maintain the dependency in a project lockfile where practical. - Prefer a local, least-privilege installation over `npm install -g`. - Disable npm lifecycle scripts with `--ignore-scripts` when they are not required. - Review the package and its transitive dependencies before recommending installation. - Document the authoritative npm publisher, source repository, expected package checksum, and update-review process. - Prefer direct access to the documented HTTPS API when installation of the MCP package is unnecessary.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The skill instructs users to submit claims to a third-party live verification service but does not clearly warn that the claim contents will be transmitted off-platform. Claims may contain sensitive, proprietary, or regulated information, so the missing disclosure creates a real privacy and data-handling risk even if the service is functioning as described.

External Transmission

Medium
Category
Data Exfiltration
Content
Send a POST request to verify a claim:

```bash
curl -X POST https://636865636b73756d.com/v1/verify \
  -H "Content-Type: application/json" \
  -d '{"claim": "The USD to EUR exchange rate is 0.92"}'
```
Confidence
94% confidence
Finding
The skill explicitly posts user-supplied claim text to an external domain, creating a direct exfiltration path for any sensitive data embedded in the claim. This is more concerning because the service is live, unauthenticated for the free tier, and presented as easy to use, which increases the chance that agents or users send confidential material without adequate scrutiny.

Unbounded Resource Access

Medium
Category
Excessive Agency
Content
## Pricing

- Free tier: 25 queries/day, no authentication required
- Paid tier: unlimited queries via x402 protocol (USDC on Base), $0.001/query

## Agent Discovery
Confidence
80% confidence
Finding
Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.

Static analysis

No suspicious patterns detected.