Security checks for vulnerabilities and agentic risk
Overview
This skill is a disclosed D&D adventure-module generator whose file writing and campaign import steps fit its stated purpose, but users should confirm database imports and prefer pinned installation sources.
Before installing, prefer a pinned ClawHub/package version or immutable source ref when available. When using the skill, review the generated file first and explicitly confirm before allowing import, re-import, indexing, deletion, or Python scene export against an existing campaign database.
The documented installation procedures invoke the skills and clawhub npm packages through npx without specifying exact package versions. Depending on the local npm configuration and cache state, npx can retrieve and execute the latest available package release.
The GitHub Skill source is also referenced by repository name rather than an immutable commit identifier. Consequently, the installer packages and effective Skill source can change after this artifact has been audited. Although skills-lock.json records a computed hash for the current Skill, it does not pin or verify the npx launcher packages used by these installation commands.
This creates a supply-chain trust boundary in which a compromised npm publisher account, malicious future package release, package-name takeover, or compromised mutable upstream repository could cause users to execute code that was not part of the reviewed artifact.
Attack Path
An attacker compromises the npm account or publication pipeline for skills or clawhub, or compromises a mutable upstream repository used during installation.
The attacker publishes a malicious version or modifies the content resolved by the installer.
A user follows the documented command without an exact package version:
bash
The skill instructs the agent to ask for parameters in Chinese and most generation templates and step labels are written in Chinese, which strongly implies a fixed language choice. There is no explicit statement offering the user a language option or requiring Chinese only in a justified region-specific context.
Content
No source excerpt is available for this finding.
Rp1
Medium
Category
MCP Rug Pull
Confidence
92% confidence
Finding
The README instructs users to run npx skills add dajiaohuang/SagaSmith-module-gen-skills without pinning an exact version or commit. This creates a supply-chain risk: if the upstream package, resolver, or referenced content changes or is compromised, users may install unexpected code or skill content. In the context of an agent skill ecosystem, installation commands are especially sensitive because they can directly introduce new executable or instruction-bearing content into developer tooling.
Content
No source excerpt is available for this finding.
Rp1
Medium
Category
MCP Rug Pull
Confidence
91% confidence
Finding
The README also provides npx clawhub install sagasmith-modulegen without a pinned version. A floating install target can resolve to newer or tampered package contents over time, enabling supply-chain compromise or silent behavior changes for users who follow the documentation. Because this is a skill installation path, the risk includes both code execution during install and unreviewed agent-instruction injection afterward.
Content
No source excerpt is available for this finding.
Rp1
Medium
Category
MCP Rug Pull
Confidence
92% confidence
Finding
The README instructs users to run npx skills add dajiaohuang/SagaSmith-module-gen-skills without pinning an exact package version. npx resolves and executes the latest published package by default, so a future malicious or compromised release could run arbitrary code on the user's machine during installation. In this context, the risk is real because the file is explicitly providing install commands for an agent skill, making copy-paste execution by users likely.
Content
No source excerpt is available for this finding.
Rp1
Medium
Category
MCP Rug Pull
Confidence
91% confidence
Finding
The command npx clawhub install sagasmith-modulegen is unpinned and therefore trusts whatever package/version is current at execution time. If the package namespace, dependency chain, or latest release is compromised, users could execute attacker-controlled code simply by following the README. Because this is an installation command in a public skill repository, the likelihood of user copy-paste increases the practical exploitability.
Content
No source excerpt is available for this finding.
Vague Triggers
Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding
The trigger phrase is broad enough to match common creative-writing or setting-generation requests, which can cause the skill to activate outside a narrowly intended domain. Overbroad activation is dangerous here because the skill contains file-writing and import/index side effects, so accidental invocation could lead to unexpected persistent changes.
Content
No source excerpt is available for this finding.
Context-Inappropriate Capability
Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding
The skill instructs database import and indexing operations in addition to generating adventure text, which expands its authority from content creation into state-changing backend actions. That mismatch is risky because a broadly triggered creative-writing skill could unexpectedly modify persistent campaign data or overwrite existing module state.
Content
No source excerpt is available for this finding.
Context-Inappropriate Capability
Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding
The skill goes beyond content generation by instructing the agent to invoke a Python CLI to export scene data. Any added code-execution surface increases risk because it can perform filesystem or environment-dependent actions not obvious from the skill's stated purpose, and the command includes user-influenced paths and campaign identifiers.
Content
No source excerpt is available for this finding.
Natural-Language Policy Violations
Low
Category
Not specified by scanner
Confidence
83% confidence
Finding
This markdown file is entirely written as the Chinese variant of the skill documentation and presents the skill as Chinese-language content without any in-file opt-in or language selection workflow. While line L003 links to an English file, this file itself embodies a locale-specific variant and therefore may conflict with a policy requiring user language choice rather than assuming a language.
Content
No source excerpt is available for this finding.
Intent-Code Divergence
Low
Category
Not specified by scanner
Confidence
93% confidence
Finding
At L177, the comment says the merge writes skeleton + ch1-3 into the final file, but L180 corrects this with 'Actually' and clarifies it is only a partial file. This is an explicit contradiction in the inline documentation about what the step does.
