PopUp Organizer

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:17 PM UTC
• Version: 2.0.0

Overview

The skill matches its organizer-management purpose, but it gives an agent broad ability to change or cancel real events and inquiries without documented confirmation safeguards.

Review this skill before installing if the connected PopUp account controls live events or vendor relationships. Use a least-privilege API key if PopUp supports it, and require the agent to show the exact event or inquiry details and ask for explicit confirmation before canceling, deleting, accepting, declining, or updating anything that could notify vendors or change account data. Publishers should also avoid the README's unpinned npx @latest workflow and avoid putting live tokens directly in shell commands.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: README.md:13
• Finding: Mutable third-party package executed through npx @latest<![CDATA[ ## Vulnerability Details **File Location**: `README.md:13`, `README.md:19-24`, and `README.md:31-36` **Vulnerability Type**: Supply-chain risk caused by unpinned package execution **Risk Level**: Medium The documented authentication and publishing workflows execute the mutable `latest` release of the third-party `clawhub` package: ```bash npx clawhub@latest auth login --token "clh_..." --no-browser --registry "https://www.clawhub.ai/" ``` ```bash npx clawhub@latest publish ./clawhub-organizer \ --slug popup-organizer \ --name "PopUp Organizer" \ --version 1.0.0 \ --changelog "Initial release: vendor search, event management, inquiries, invoices, saved vendors, profile" \ --tags "events,vendors,food-trucks,marketplace,booking,invoicing,organizer" ``` ```bash npx clawhub@latest publish ./clawhub-organizer \ --slug popup-organizer \ --name "PopUp Organizer" \ --version 1.1.0 \ --changelog "Description of changes" \ --tags "events,vendors,food-trucks,marketplace,booking,invoicing,organizer" ``` ### Technical Analysis The `@latest` version specifier is mutable and does not identify a specific reviewed package release. When these commands are run, `npx` may download and execute whichever package version the registry currently designates as the latest release. Consequently, the code executed by the documented workflow can change after this skill has been reviewed. If the package publisher account, package distribution process, or registry is compromised—or if a future release contains a malicious or unexpectedly unsafe lifecycle/runtime behavior—the downloaded package could execute attacker-controlled JavaScript under the invoking user's account. No malicious dependency is present in the audited project itself; this finding concerns the unsafe dependency-execution procedure documented in `README.md`. ### Attack Path 1. An attacker compromises the `clawhub` package publisher, its release pipeline, or the package source served by t ...[truncated 1068 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace `clawhub@latest` with an exact, reviewed version, for example: ```bash npx --yes clawhub@1.0.0 auth login ... ``` The actual version should be selected only after review rather than copied from this illustrative example. 2. Record and review upgrades explicitly instead of allowing the `latest` tag to change executable behavior automatically. 3. Where supported, install dependencies through a lockfile-backed workflow and enforce package integrity hashes. 4. Verify package provenance, publisher identity, signatures, and registry configuration before execution. 5. Run publishing tools in a minimally privileged, isolated environment with access only to the files and credentials required for publication. 6. Configure CI systems to use a pinned tool version and narrowly scoped, short-lived publication credentials. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: README.md:13
• Finding: Authentication token passed directly through a command-line argument<![CDATA[ ## Vulnerability Details **File Location**: `README.md:13` **Vulnerability Type**: Sensitive credential exposure through process arguments and shell history **Risk Level**: Medium The authentication instructions tell users to replace a placeholder with their real CLI token and pass it directly as a command-line argument: ```bash npx clawhub@latest auth login --token "clh_..." --no-browser --registry "https://www.clawhub.ai/" ``` The accompanying instruction states: ```text Replace `clh_...` with your actual CLI token. ``` ### Technical Analysis Command-line arguments can be retained in interactive shell history and may be captured by terminal session recording, command auditing, CI logs, diagnostic output, or process inspection. The exact visibility of process arguments depends on the operating system and its process-isolation configuration, but shell-history exposure alone can persist after the command terminates. Because users are explicitly instructed to substitute the placeholder with a live token, following the documentation can place a reusable credential into these exposure channels. Quoting the token does not prevent it from being recorded. ### Attack Path 1. A maintainer replaces `clh_...` with a valid ClawHub CLI token as instructed. 2. The shell records the complete command in its history, or an automation/logging system records the invoked command. 3. A local user, support operator, compromised process, CI-log reader, or other party with access to the retained command obtains the token. 4. The attacker submits the exposed token to the associated registry. 5. Subject to the token's permissions, the attacker authenticates as the token owner and performs unauthorized registry actions. ### Impact Assessment The attacker could obtain the privileges granted to the exposed ClawHub token. Depending on its scope, this may include reading account or package information, publishing altered skill versions, or otherwise modifying artifacts ow ...[truncated 287 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Prefer an interactive hidden prompt supplied by the CLI so the token is not included in command arguments. 2. If the tool supports it, provide the credential through a protected environment variable or standard input. Ensure the tool does not echo the value. 3. For automated environments, use the CI platform's secret store and masking controls rather than embedding the token in scripts or command text. 4. Use short-lived, narrowly scoped tokens limited to the required registry and publishing operations. 5. Document safe credential handling, including shell-history cleanup, log review, and immediate rotation if a live token was previously entered on the command line. 6. Restrict access to CI logs and disable verbose command tracing such as `set -x` around authentication operations. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (9)

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

### Cancel Event

`DELETE /open-events/{eventId}`

Cancel an event. All pending and accepted vendors are notified.

• Confidence: 93% confidence
• Finding: `DELETE /open-events/{eventId}` is a destructive operation parameterized by an event ID, with no described safeguards against misuse, wrong-target selection, or confirmation bypass. In a skill that manages real organizer data, parameter abuse could cancel the wrong event and automatically notify vendors, causing operational and reputational damage.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

### Delete Inquiry

`DELETE /inquiries/{id}`

Delete a pending inquiry. Only works on `status=pending`.

• Confidence: 86% confidence
• Finding: `DELETE /inquiries/{id}` is also a destructive, ID-driven operation with no documented confirmation or provenance controls for the identifier. An agent that accepts arbitrary IDs or acts on ambiguous instructions could delete the wrong pending inquiry, losing booking context and communications.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

### Remove Saved Vendor

`DELETE /saved?businessId=...`

Remove a bookmarked vendor.

• Confidence: 80% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence
• Finding: The README instructs users to run `npx clawhub@latest`, which fetches and executes the latest package version at runtime rather than a pinned, reviewed release. If the upstream package, dependency chain, or publishing account is compromised, users following these instructions could execute attacker-controlled code and expose the provided CLI token.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence
• Finding: This publish command again uses `npx clawhub@latest`, causing execution of whatever version is current at the time the command is run. In this skill context, the command is used to publish a package to a registry, so a malicious package update could steal credentials, alter published artifacts, or perform unauthorized actions.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence
• Finding: The verification step still relies on `npx clawhub@latest`, which means even a read-oriented command can execute newly published code from the package registry. While the immediate action is lower risk than authentication or publishing, it still creates a supply-chain execution path from documentation to user environment.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence
• Finding: The update workflow repeats the same unpinned `npx clawhub@latest` pattern for a privileged publishing action. Because this skill concerns organizer API access and deployment/publication workflows, compromising the invoked CLI could impact account integrity, published skill contents, and any credentials present in the user's environment.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill documents a destructive cancellation endpoint that affects real event records and triggers vendor notifications, but it does not instruct the agent to obtain explicit confirmation before use. In an agentic context, that omission is dangerous because a mistaken or prompt-injected action could cancel live events and disrupt vendor relationships.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The skill exposes deletion of pending inquiries without a user-warning or confirmation pattern. Although narrower in scope than event cancellation, an agent could still remove legitimate booking inquiries through misunderstanding, ambiguous prompts, or prompt injection.

Static analysis

No suspicious patterns detected.