PopUp Referrals

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:18 PM UTC
• Version: 1.1.0

Overview

The skill is a coherent read-only PopUp referral viewer, but its README includes risky maintainer commands that run an unpinned CLI and place a real token on the command line.

Installing the skill for read-only referral lookup appears aligned with its stated purpose, but maintainers should not follow the README commands as written. Use a pinned or locally vetted ClawHub CLI version, avoid putting real tokens directly in command-line arguments, and rotate any token previously used that way.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: README.md:12

Finding

Execution of an Unpinned Mutable npm Package

Content

View full analysis

Vulnerability Details

File Location: README.md, lines 12-37
Vulnerability Type: Supply-chain risk caused by unpinned package execution
Risk Level: Medium

Vulnerable Code

bash

npx clawhub@latest auth login --token "clh_..." --no-browser --registry "https://www.clawhub.ai/"

bash

npx clawhub@latest publish ./clawhub-skill \
  --slug popup-referrals \
  --name "PopUp Referrals" \
  --version 1.1.0 \
  --changelog "v1.1.0: Improved skill description and metadata" \
  --tags "referrals,earnings,vendors,popup"

bash

npx clawhub@latest publish ./clawhub-skill \
  --slug popup-referrals \
  --name "PopUp Referrals" \
  --version 1.2.0 \
  --changelog "Description of changes" \
  --tags "referrals,earnings,vendors,popup"

Technical Analysis

The publishing instructions use npx with the mutable latest package tag. If the requested package version is not already available locally, npx may download and immediately execute package code from the configured npm registry. The latest tag can be changed after this project has been reviewed, so the effective code executed by these commands is neither version-pinned nor integrity-verified.

This creates a supply-chain trust boundary outside the audited project. A compromised maintainer account, malicious package release, registry compromise, or compromised transitive dependency could cause arbitrary JavaScript to execute when a maintainer follows the documented workflow.

Attack Path

1. An attacker compromises the clawhub npm package, its publishing account, its distribution channel, or a dependency used during CLI startup.
2. The attacker publishes a malicious release and assigns it to the latest tag.
3. A project maintainer follows README.md and runs one of the documented npx clawhub@latest commands.
4. npx retrieves and executes the attacker-controlled package in the maintainer's local environment. ...[truncated 665 chars]

Remediation

View remediation

Remediation Suggestions

• Replace clawhub@latest with a reviewed, exact package version, such as clawhub@1.2.3.
• Commit and enforce an appropriate lockfile where the publishing tool is managed as a project dependency.
• Use deterministic installation commands that enforce lockfile integrity.
• Verify package provenance, registry origin, checksums, and signatures before execution.
• Review dependency updates before changing the pinned version.
• Run publishing tooling in an isolated, minimally privileged environment with only the credentials required for publication.
• Avoid exposing unrelated environment variables, SSH agents, or filesystem mounts to the publishing process.

T09 · Insecure Skill Coding Practices

Warning

• Location: README.md:12

Finding

Authentication Token Passed Through a Command-Line Argument

Content

View full analysis

Vulnerability Details

File Location: README.md, line 12
Vulnerability Type: Credential exposure through process arguments and shell history
Risk Level: Medium

Vulnerable Code

bash

npx clawhub@latest auth login --token "clh_..." --no-browser --registry "https://www.clawhub.ai/"

The accompanying instruction tells users to replace clh_... with their actual CLI token.

Technical Analysis

Passing a secret through the --token command-line option can expose it outside the intended authentication process. Depending on the operating system, shell, terminal tooling, and logging configuration, the complete command may be retained in shell history, terminal transcripts, command auditing records, diagnostic output, or automation logs. Process arguments may also be observable by other local processes or users while the command is running.

Although the repository contains only a placeholder and does not hardcode a real token, the documented workflow directs users to place a real credential in an exposure-prone channel.

Attack Path

1. A user replaces the placeholder with a valid ClawHub CLI token and runs the documented command.
2. The shell records the command in its history, or the command is captured by process monitoring, CI logs, terminal recording, or audit tooling.
3. Another local user, malicious process, log reader, or party with access to synchronized shell history retrieves the token.
4. The attacker submits the stolen token to the ClawHub service.
5. The attacker performs operations permitted by the token, potentially including accessing account resources or publishing modified skill versions.

Impact Assessment

Exploitation grants the attacker the service privileges assigned to the exposed ClawHub token. Depending on token scope, this may permit account impersonation, unauthorized publication or modification of packages, access to private registry information, or other authent ...[truncated 221 chars]

Remediation

View remediation

Remediation Suggestions

• Do not instruct users to place authentication tokens directly in command-line arguments.
• Prefer an interactive hidden prompt or standard input that does not echo or persist the token.
• If supported by the CLI, read the credential from a protected environment variable or operating-system credential store without reproducing it in command output.
• Ensure CI systems inject the token through a secret manager and mask it in all logs.
• Use short-lived, narrowly scoped tokens with only the permissions required for publication.
• Document immediate token revocation and rotation procedures for suspected exposure.
• Advise users who previously followed the command with a real token to remove relevant shell-history entries and rotate the credential.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (4)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The README instructs users to run npx clawhub@latest, which fetches and executes the latest package version at runtime rather than a reviewed, immutable release. If the package is compromised, typosquatted, or a malicious update is published, users following the documentation could execute attacker-controlled code during authentication or publishing.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

This publish command again relies on npx clawhub@latest, causing remote code to be resolved and executed dynamically at the time the user runs it. Because publishing workflows often involve credentials and package metadata, a compromised upstream release could steal tokens or alter what gets published.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The verification step still uses npx clawhub@latest, so even a seemingly harmless info command may execute newly downloaded code from the package registry. In this skill context, the README is operational guidance for users, so unsafe install-and-run instructions directly increase supply-chain risk for anyone managing the skill.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The update instructions repeat the same unpinned @latest pattern, exposing maintainers to arbitrary code execution from future package releases during a sensitive publishing action. Since this is repeated across the documentation, it reflects a systemic supply-chain hygiene issue rather than an isolated typo.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.