T08 · Insecure Dependencies
Warning
- Location
README.md:13- Finding
Mutable third-party package executed through npx @latest
- Content
View full analysis
- Remediation
View remediation
Security audit
PopUp Organizer
Security checks for vulnerabilities and agentic risk
Overview
The skill matches its organizer-management purpose, but it gives an agent broad ability to change or cancel real events and inquiries without documented confirmation safeguards.
Review this skill before installing if the connected PopUp account controls live events or vendor relationships. Use a least-privilege API key if PopUp supports it, and require the agent to show the exact event or inquiry details and ask for explicit confirmation before canceling, deleting, accepting, declining, or updating anything that could notify vendors or change account data. Publishers should also avoid the README's unpinned npx @latest workflow and avoid putting live tokens directly in shell commands.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
README.md:13- Finding
Authentication token passed directly through a command-line argument
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (9)
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 93% confidence
- Finding
DELETE /open-events/{eventId}is a destructive operation parameterized by an event ID, with no described safeguards against misuse, wrong-target selection, or confirmation bypass. In a skill that manages real organizer data, parameter abuse could cancel the wrong event and automatically notify vendors, causing operational and reputational damage.- Content
md ### Cancel Event `DELETE /open-events/{eventId}` Cancel an event. All pending and accepted vendors are notified.
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 86% confidence
- Finding
DELETE /inquiries/{id}is also a destructive, ID-driven operation with no documented confirmation or provenance controls for the identifier. An agent that accepts arbitrary IDs or acts on ambiguous instructions could delete the wrong pending inquiry, losing booking context and communications.- Content
md ### Delete Inquiry `DELETE /inquiries/{id}` Delete a pending inquiry. Only works on `status=pending`.
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 80% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md ### Remove Saved Vendor `DELETE /saved?businessId=...` Remove a bookmarked vendor.
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 96% confidence
- Finding
The README instructs users to run
npx clawhub@latest, which fetches and executes the latest package version at runtime rather than a pinned, reviewed release. If the upstream package, dependency chain, or publishing account is compromised, users following these instructions could execute attacker-controlled code and expose the provided CLI token.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 97% confidence
- Finding
This publish command again uses
npx clawhub@latest, causing execution of whatever version is current at the time the command is run. In this skill context, the command is used to publish a package to a registry, so a malicious package update could steal credentials, alter published artifacts, or perform unauthorized actions.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 94% confidence
- Finding
The verification step still relies on
npx clawhub@latest, which means even a read-oriented command can execute newly published code from the package registry. While the immediate action is lower risk than authentication or publishing, it still creates a supply-chain execution path from documentation to user environment.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 97% confidence
- Finding
The update workflow repeats the same unpinned
npx clawhub@latestpattern for a privileged publishing action. Because this skill concerns organizer API access and deployment/publication workflows, compromising the invoked CLI could impact account integrity, published skill contents, and any credentials present in the user's environment.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill documents a destructive cancellation endpoint that affects real event records and triggers vendor notifications, but it does not instruct the agent to obtain explicit confirmation before use. In an agentic context, that omission is dangerous because a mistaken or prompt-injected action could cancel live events and disrupt vendor relationships.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The skill exposes deletion of pending inquiries without a user-warning or confirmation pattern. Although narrower in scope than event cancellation, an agent could still remove legitimate booking inquiries through misunderstanding, ambiguous prompts, or prompt injection.
- Content