ClawHub
Back to skill

Security audit

Sa Clean

Security checks for vulnerabilities and agentic risk

Overview

The skill is a disclosed SEO-audit helper with expected website crawling and Anthropic API use, but the package is incomplete and uses unpinned dependencies.

Before installing, treat this as incomplete: the documented Python script is not present, so the advertised commands may fail and key handling cannot be reviewed. If the publisher updates it, prefer pinned dependencies and review the implementation before providing an Anthropic API key or auditing sensitive internal URLs.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:31
Finding

Unpinned Third-Party Dependencies Create a Supply-Chain Risk

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 31–40
Vulnerability Type: Unpinned third-party dependencies
Risk Level: Medium

yaml
install:
  - kind: uv
    package: requests
    bins: []
  - kind: uv
    package: beautifulsoup4
    bins: []
  - kind: uv
    package: anthropic
    bins: []

Technical Analysis

The installation configuration declares requests, beautifulsoup4, and anthropic without exact versions, integrity hashes, or a lockfile. Each installation can therefore resolve to the latest package version accepted by the package manager rather than a previously reviewed artifact.

These dependencies are consistent with the Skill's declared website crawling and Anthropic API functionality, and there is no evidence that their package names are intentionally malicious. Nevertheless, unconstrained dependency resolution weakens build reproducibility and exposes installations to upstream package compromise, malicious releases, or unexpected security regressions.

The artifact contains only SKILL.md; the referenced seo_audit_skill.py implementation is absent. Therefore, dependency import behavior and the handling of ANTHROPIC_API_KEY cannot be verified.

Attack Path

  1. An attacker compromises an upstream dependency project, maintainer account, publishing token, or package distribution channel.
  2. The attacker publishes a malicious or backdoored release under one of the declared package names.
  3. A user installs the Skill after that release becomes the version selected by the unconstrained resolver.
  4. Malicious package logic executes during installation or when the package is imported by the Skill.
  5. The malicious logic accesses resources available to the installation or runtime process, potentially including environment variables such as ANTHROPIC_API_KEY, local files, and outbound network access.
  6. The accessed information may then be transmitted to at ...[truncated 661 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin every dependency to an explicitly reviewed version, for example with exact == constraints.
  2. Generate and commit a lockfile containing resolved transitive dependencies.
  3. Require cryptographic hashes for downloaded distributions where supported.
  4. Restrict dependency retrieval to an approved package registry and disable untrusted supplemental indexes.
  5. Prefer reviewed, immutable artifacts and verify package provenance or signatures when available.
  6. Add automated dependency vulnerability and provenance scanning to the release process.
  7. Re-review and deliberately update pinned versions on a controlled schedule.
  8. Include the referenced seo_audit_skill.py in future audit submissions so API-key handling, outbound destinations, SSRF protections, redirect behavior, timeouts, and response-size limits can be assessed.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.