Contract Reviewer Dongjie

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 5:06 AM UTC
• Version: 0.1.0

Overview

This skill is a simple local contract text checker with no evidence of hidden data access, persistence, command execution, or exfiltration.

This appears safe to use as a lightweight local text checker, but treat it as a basic keyword-based aid rather than legal advice. Before publishing or installing in strict workflows, the maintainer should regenerate or remove the stale lockfile so unnecessary dependencies are not processed.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Note

• Location: package-lock.json:5

Finding

Manifest and Lockfile Drift Introduces an Unnecessary Dependency Tree

Content

View full analysis

Vulnerability Details

File Location: package-lock.json:5-9 and package.json:8
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Low

The dependency-free manifest conflicts with the lockfile, which records clawhub and its transitive dependency tree.

json

// package-lock.json:5-9
"": {
  "dependencies": {
    "clawhub": "^0.9.0"
  }
}

json

// package.json:8
"dependencies": {}

The locked package expands into multiple transitive dependencies:

json

// package-lock.json:92-117
"node_modules/clawhub": {
  "version": "0.9.0",
  "resolved": "https://registry.npmjs.org/clawhub/-/clawhub-0.9.0.tgz",
  "integrity": "sha512-p4qFJ84qF194KlGj0LlnuggPk0kKRgbp1wN27aJnRQ5FkwXlEalGqw8wngG2Ghca7q6vbvyVoI4V4KDv2zJWdQ==",
  "license": "MIT",
  "dependencies": {
    "@clack/prompts": "^1.1.0",
    "arktype": "^2.2.0",
    "commander": "^14.0.3",
    "fflate": "^0.8.2",
    "ignore": "^7.0.5",
    "json5": "^2.2.3",
    "mime": "^4.1.0",
    "ora": "^9.3.0",
    "p-retry": "^7.1.1",
    "semver": "^7.7.4",
    "undici": "^7.24.0"
  },
  "bin": {
    "clawdhub": "bin/clawdhub.js",
    "clawhub": "bin/clawdhub.js"
  },
  "engines": {
    "node": ">=20"
  }
}

Technical Analysis

main.js does not import or use clawhub, and package.json explicitly declares no dependencies. The stale lockfile nevertheless retains clawhub and numerous transitive packages. Depending on the package-manager command and version, installation may reject the inconsistency or process unnecessary third-party packages.

Every unnecessary dependency increases supply-chain exposure, including the possibility that a future compromised release, registry incident, or vulnerable transitive package affects installation. The reviewed lockfile currently uses standard npm registry URLs and integrity hashes; no malicious source, lifecycle script, or malicious behavi ...[truncated 1378 chars]

Remediation

View remediation

Remediation Suggestions

1. Delete the stale lockfile and regenerate it from the current manifest:

   bash

   rm package-lock.json
   npm install --package-lock-only
   

2. Confirm that the regenerated root package entry contains no dependency on clawhub.
3. Commit package.json and package-lock.json together whenever dependencies change.
4. Add a CI clean-install check, such as npm ci, to reject future manifest and lockfile drift.
5. Keep the Skill dependency-free unless an external package is required by main.js.
6. If dependencies are introduced later, pin reviewed versions, retain integrity metadata, and run dependency vulnerability and provenance checks in CI.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Known Vulnerable Dependency: undici==7.24.7 — 12 advisory(ies): CVE-2026-6733 (undici vulnerable to HTTP response queue poisoning via keep-alive socket reuse); CVE-2026-13697 (undici vulnerable to cross-user information disclosure and parse-time crash via ); CVE-2026-16728 (undici vulnerable to downstream response desynchronization via retry interceptor) +9 more

High

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The lockfile pins undici to 7.24.7, and the listed advisories describe multiple high-severity issues affecting HTTP connection reuse, response parsing, and request/response desynchronization. Because agent skills commonly make outbound HTTP requests and may handle sensitive prompts, tokens, or retrieved data, flaws in the HTTP client can enable information disclosure, response confusion, or poisoning across requests.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 76% confidence

Finding

The hardcoded summary string "Contract Reviewer Dongjie processed the text." injects a fixed name/persona into user-facing output regardless of user preference or context. If organizational policy requires neutral or user-selected language/locale conventions, this kind of forced labeling can be a natural-language policy issue.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: fflate==0.8.2 — 1 advisory(ies): CVE-2026-45820 (fflate unzipSync can enter an infinite loop when parsing malformed ZIP64 archive)

Low

• Category: Supply Chain
• Confidence: 96% confidence

Finding

The lockfile pins fflate to 0.8.2, and the provided advisory indicates this version is vulnerable to an infinite loop when parsing malformed ZIP64 archives. In a skill context, this is a real supply-chain risk if the dependency is used on untrusted archive input, though the likely consequence is denial of service rather than code execution.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.