ClawHub
Back to skill

Security audit

Cooking Recipe

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward recipe and grocery-list helper that discloses its backend use and credential setup, with a minor install-provenance caution.

Install only from the expected ClawHub package source, prefer a self-hosted CONVEX_URL, enable the shared backend only intentionally with ALLOW_DEFAULT_BACKEND=true, and keep OAuth secrets out of chat or logs.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:28
Finding

Unpinned External Package Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 28-31
Vulnerability Type: Unpinned third-party dependency installation
Risk Level: Medium

Vulnerable Code

markdown
1. Install:
   ```bash
   clawdhub install cooking-recipe
   ```

Technical Analysis

The installation instruction retrieves the cooking-recipe package without specifying an immutable version, integrity hash, commit identifier, or other verification mechanism. The executable implementation is not included in the reviewed artifact, so the code that handles OAuth credentials, backend communication, recipes, and grocery lists cannot be verified from the supplied project.

Because package resolution can change after this skill has been reviewed, a compromised, replaced, or unexpectedly updated registry release could cause users to install code different from the implementation originally intended. This is a supply-chain risk rather than evidence that the current external package is malicious.

Attack Path

  1. An attacker compromises the package publisher account, registry entry, distribution infrastructure, or another component of the external package supply chain.
  2. The attacker publishes a modified release under the package name cooking-recipe.
  3. A user follows the documented command without selecting a trusted immutable version.
  4. The package manager resolves and installs the attacker-controlled release.
  5. When invoked, the installed package executes with the permissions of the user running the CLI.
  6. The malicious release may read accessible environment variables, including configured OAuth credentials, manipulate local files available to that user, or redirect authentication and recipe-related traffic.

Impact Assessment

Successful exploitation could permit arbitrary code execution with the privileges of the user who installs or runs the package. Within that user's access boundaries, a malicious depend ...[truncated 501 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin cooking-recipe to a specific immutable version rather than installing the mutable latest release.
  2. Require verification using a cryptographic integrity hash, signed release, or equivalent package-manager integrity control.
  3. Explicitly document the trusted registry and canonical publisher identity to reduce dependency-confusion and package-substitution risks.
  4. Include the CLI source code, dependency manifest, and lockfile in the auditable artifact so its credential handling and network behavior can be reviewed.
  5. Use automated dependency and provenance verification in the release pipeline, such as signature validation, reproducible builds, and software-bill-of-materials generation.
  6. Run the CLI with least privilege and expose only the environment variables required for the specific operation.
  7. Provide the missing .env.example and referenced output-template file so configuration defaults and secret-handling behavior can be reviewed.

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 38)May include surrounding context.

  1. Configure environment:

    bash
    cp .env.example .env

  2. Environment variables:

Static analysis

No suspicious patterns detected.