ClawHub
Back to skill

Security audit

Content Gen

Security checks for vulnerabilities and agentic risk

Overview

The skill is a content-generation helper, but it overstates unverifiable quality scoring and encourages presenting that score as proof while only partially disclosing external LLM data handling.

Review before installing if you plan to use the score in customer-facing material or paste private business/customer notes. Treat the score as an internal heuristic unless the publisher provides an auditable scoring implementation and methodology, avoid sensitive inputs unless external LLM transmission is acceptable, and prefer a pinned dependency or locked install path.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Note
Location
SKILL.md:15
Finding

Unpinned Third-Party npm Dependency

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 15–18
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Low

yaml
install:
  - kind: node
    package: "@anthropic-ai/sdk"
    bins: []

Technical Analysis

The skill declares @anthropic-ai/sdk without an exact version, lockfile, or integrity hash. Consequently, installation may resolve a mutable package release rather than a specific reviewed artifact. If the upstream package or distribution channel is compromised, a malicious release could be installed without any change to this repository.

The dependency name is consistent with the documented Anthropic integration. No evidence of dependency confusion, typosquatting, an unsafe package source, or an existing malicious package was identified. This finding concerns the absence of reproducible dependency pinning and integrity controls.

Attack Path

  1. An attacker compromises the upstream package publisher account, package, or registry distribution process.
  2. The attacker publishes a malicious version under the legitimate @anthropic-ai/sdk package name.
  3. The skill is installed or reinstalled while no exact version constraint or trusted lockfile is enforced.
  4. The package manager resolves and downloads the compromised release.
  5. Malicious dependency code executes during an installation lifecycle hook or when the skill loads and uses the SDK.

This path depends on a separate upstream supply-chain compromise; the audited file does not itself retrieve a known malicious package.

Impact Assessment

Successful exploitation could execute code with the privileges of the account installing or running the skill. Depending on that account's access, the malicious dependency could read environment variables—including the declared ANTHROPIC_API_KEY—access user-readable files, alter project data, or make unauthorized network requests.

The potential scope is the local account or container running the installation or s ...[truncated 121 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin @anthropic-ai/sdk to a reviewed exact version rather than relying on mutable resolution.
  2. Use and enforce a package-manager lockfile containing integrity metadata.
  3. Install dependencies with immutable or frozen-lockfile settings in CI and production.
  4. Enable registry provenance and signature verification where supported.
  5. Disable dependency lifecycle scripts unless they are explicitly required and reviewed.
  6. Add automated dependency scanning and controlled update review.
  7. Run installation and skill execution in a least-privileged, isolated environment with only the required secrets and filesystem access.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill advertises built-in neural scoring, threshold gating, and automatic rewrites as if they are implemented guarantees, but this file contains only descriptive claims and no verifiable mechanism. That can mislead users into trusting content quality controls that may not exist, creating integrity and compliance risk when the score is used as evidence or proof in customer-facing workflows.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The documentation explicitly tells users to present the score as proof and says buyers do not need to understand the methodology. That encourages deceptive use of unverifiable scoring claims, which can mislead customers, inflate trust in generated content, and create fraud, reputational, or regulatory exposure if the scoring basis is weak or nonexistent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill invites users to provide 'specific topic or paste raw notes' and states there is a Haiku fallback, but it does not warn that user content may be transmitted to an external LLM service. This creates a real privacy and data-handling risk because users may paste sensitive business, customer, or regulated information under the assumption that scoring is local and generation behavior is transparent.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
86% confidence
Finding

The backend section claims generation uses a shared backend with local scoring and a Haiku fallback, but the skill file provides no implementation or invocation details to substantiate that behavior. This is dangerous because operators may assume privacy, execution path, or local-only processing properties that are not actually enforced by the packaged skill definition.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.