clawsec-clawhub-checker

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:02 PM UTC
• Version: 0.0.8

Overview

The skill's code is a disclosed ClawHub reputation-checking wrapper, but its documented install path uses mutable unpinned packages for a security-sensitive installer.

Before installing, prefer a pinned and verified release of this exact skill and its clawsec-suite dependency instead of the documented latest/unpinned npx commands. Expect it to query ClawHub for metadata and to invoke the clawsec-suite guarded installer for user-specified skills; only use confirmation overrides after reviewing the target skill code.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:17

Finding

Unpinned Vercel Skills CLI and repository source are executed during installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:17-21 and README.md:4-8
Vulnerability Type: Unpinned third-party executable and mutable repository dependency
Risk Level: Medium

Vulnerable Code

bash

npx skills add prompt-security/clawsec --skill clawsec-clawhub-checker -a openclaw -y

Technical Analysis

The documented installation command invokes the skills npm package through npx without specifying an exact package version or integrity hash. It also identifies the skill source as prompt-security/clawsec without pinning it to an immutable commit or signed release artifact.

Consequently, the code executed or installed by this command can differ from the version reviewed during this audit. If the npm package, package maintainer account, repository, default branch, or publishing pipeline is compromised, a future invocation could retrieve attacker-controlled content. npm lifecycle behavior or the invoked CLI could execute code with the privileges of the user running the command.

The -y option also makes the documented flow non-interactive, reducing the opportunity for the operator to notice an unexpected package version or source change.

Attack Path

1. An attacker compromises the npm package used by npx skills, its maintainer account, or the referenced repository and publishing pipeline.
2. The attacker publishes a malicious version of the package or replaces content at the mutable repository reference.
3. A user follows the documented installation command.
4. npx resolves the currently available package rather than an audited, exact version.
5. The compromised CLI or retrieved skill content executes or is installed under the user's OpenClaw environment.
6. Malicious code can then act with the permissions available to that user.

Impact Assessment

Successful supply-chain exploitation could provide arbitrary code execution with the privileges of the invoking user. This ...[truncated 351 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the skills npm package to a reviewed exact version instead of relying on implicit resolution, for example npx skills@X.Y.Z.
• Pin prompt-security/clawsec to an immutable commit SHA or a cryptographically verified release tag.
• Publish and verify checksums or signatures for the exact skill archive before installation.
• Avoid non-interactive approval in security-sensitive installation instructions unless package identity, version, and integrity have already been verified.
• Recommend running the installer in a restricted environment without unnecessary credentials or filesystem permissions.
• Document the expected npm package name, version, integrity digest, repository commit, and signing-key fingerprint.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:41

Finding

Guard and checker installation relies on mutable ClawHub package versions

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:41-45 and README.md:27-31
Vulnerability Type: Mutable and unpinned installation dependencies
Risk Level: Medium

Vulnerable Code

SKILL.md recommends explicitly resolving the latest available packages:

bash

npx clawhub@latest install clawsec-suite
npx clawhub@latest install clawsec-clawhub-checker

README.md similarly omits package versions:

bash

npx clawhub install clawsec-suite
npx clawhub install clawsec-clawhub-checker

Technical Analysis

The installation instructions resolve both the clawhub CLI and installed skills through mutable package references. In SKILL.md, clawhub@latest intentionally selects whichever CLI release currently owns the latest tag. The README does not pin the CLI at all. Neither command pins clawsec-suite or clawsec-clawhub-checker to the audited versions.

This weakens reproducibility and allows future package releases, registry tag changes, account compromise, or publishing-pipeline compromise to alter the effective code. This is particularly significant because enhanced_guarded_install.mjs later delegates installation to clawsec-suite at ~/.openclaw/skills/clawsec-suite/scripts/guarded_skill_install.mjs. Trusting a mutable suite version therefore affects the downstream security gate itself.

Although SKILL.md separately provides signed release verification instructions, the ordinary installation commands shown above do not enforce that verification before executing the package manager and installing the skills.

Attack Path

1. An attacker compromises the npm clawhub package, its dist-tags, a ClawHub skill publisher, or the relevant release pipeline.
2. The attacker publishes a malicious CLI or skill version and makes it the default or latest version.
3. A user runs one of the documented installation commands.
4. npx downloads and invokes the mutable CLI, which insta ...[truncated 936 chars]

Remediation

View remediation

Remediation Suggestions

• Replace clawhub@latest and unversioned clawhub usage with an exact, reviewed CLI version.
• Pin both installed skills to exact versions, including the declared clawsec-clawhub-checker release and a reviewed compatible clawsec-suite release.
• Integrate the documented signed-manifest verification into the default installation flow rather than presenting it only as an optional standalone procedure.
• Verify the archive checksum, metadata checksums, signature, and pinned signing-key fingerprint before extraction or execution.
• Prefer immutable release URLs and reject redirects or metadata that resolve to unexpected versions.
• Record expected hashes in release documentation and fail closed if any version, signature, or digest differs.
• Run package installation with least privilege and without unrelated secrets in the environment.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (12)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 58)May include surrounding context.

md

For standalone installs, verify the signed release manifest before trusting `SKILL.md`, `skill.json`, or the archive. The `skill.json` file is the package metad

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 127)May include surrounding context.

md

For standalone installs, verify the signed release manifest before trusting `SKILL.md`, `skill.json`, or the archive. The `skill.json` file is the package metad

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 74)May include surrounding context.

md

RELEASE_PUBKEY_SHA256="711424e4535f84093fefb024cd1ca4ec87439e53907b305b79a631d5befba9c8"

curl -fsSL "$BASE/checksums.json" -o "$TMP_DIR/checksums.json"
curl -fsSL "$BASE/checksums.sig" -o "$TMP_DIR/checksums.sig"
curl -fsSL "$BASE/signing-public.pem" -o "$TMP_DIR/signing-public.pem"
curl -fsSL "$BASE/$ZIP_NAME" -o "$TMP_DIR/$ZIP_NAME"

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The README instructs users to run npx skills without pinning an exact package version, which can fetch and execute whatever version is current at install time. If the package is compromised, typo-squatted, or a malicious update is published, users could execute unreviewed code during installation.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

The command npx clawhub install clawsec-suite executes an unpinned package from the registry, making the install path depend on the latest published version at runtime. That creates a supply-chain risk where a compromised release or dependency could run arbitrary code on the user's machine.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

The command npx clawhub install clawsec-clawhub-checker also relies on an unpinned runtime package, so users may execute a different version than expected, including a malicious or compromised release. Because this is a security-related skill, trust in the installation path is especially important and the contradiction makes the issue somewhat more dangerous in context.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence

Finding

The installation command uses npx skills without a pinned version, so execution depends on whatever package version the registry serves at install time. If the upstream package is compromised or a breaking/malicious release is published, users could run unreviewed code during installation.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 29)May include surrounding context.

md

- Required runtime: `node`, `clawhub`, `openclaw`
- Depends on: installed `clawsec-suite`
- Side effects: none on other skills; this package does not rewrite installed suite files
- Advisory-hook wiring is optional and manual in this release
- Network behavior: reputation checks call ClawHub inspect/search endpoints
- Trust model: scores are heuristic and confirmation-gated

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

npx clawhub@latest install clawsec-suite executes the latest published package version, which is mutable over time and may differ from what was reviewed. This creates a supply-chain risk where a compromised or malicious release could be executed on the user's system.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

npx clawhub@latest install clawsec-clawhub-checker has the same supply-chain exposure as the prior command: it executes a moving target from the package registry. In a security-focused installer, this is especially risky because users may overtrust the command due to the tool's stated purpose.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The trigger phrases "safe skill install", "check skill safety", and "skill security score" are generic enough to match broad user safety or security requests that are not specifically about this skill. In an agent ecosystem, overly broad triggers can cause unintended invocation of this skill, creating routing confusion and potentially exposing users to heuristic security judgments in contexts where they did not request this tool.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.