Security audit

Find Skills Skill

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward guide for finding OpenClaw skills, with a notable but disclosed supply-chain caution around unpinned npx examples.

Use this skill as a discovery checklist, but avoid copy-pasting unpinned npx commands in sensitive environments. Prefer a reviewed pinned version of the clawhub CLI or the listed website and GitHub search options when possible.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:35
Finding: Unpinned npm Package Execution Through npx
Content: View full analysis
Remediation: View remediation
search "keyword" ``` 2. Prefer installing the reviewed version through a controlled dependency manifest and lockfile, then invoke the locked local binary: ```bash npm install --save-exact clawhub@ npx --no-install clawhub search "keyword" ``` 3. Document the authoritative package name, publisher, registry, and expected version so users can detect typosquatting or registry substitution. 4. Commit and verify an npm lockfile where the project model permits it. Use lockfile integrity metadata and a trusted registry. 5. Review package source, lifecycle scripts, ownership changes, and published artifacts before approving upgrades. Apply upgrades through an explicit review process rather than accepting the latest release automatically. 6. Run the CLI in a least-privilege, isolated environment without unrelated credentials or sensitive filesystem access, especially when evaluating a new version. 7. Consider disabling lifecycle scripts during installation where compatible, and verify package provenance or signatures when supported by the package distribution workflow. ]]>

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (10)

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: The skill instructs users to run npx clawhub search "keyword" without pinning a specific package version. npx may fetch and execute the latest published package, so a compromised maintainer account, malicious update, or dependency hijack could lead to arbitrary code execution on the user's machine. Because this is a discovery skill that explicitly recommends repeated CLI execution, the exposure is real rather than theoretical.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: The command npx clawhub browse invokes an unpinned package via npx, which can download and execute whatever version is current at invocation time. If the package or one of its dependencies is compromised, this becomes a supply-chain execution vector. The skill's role as a how-to document increases the likelihood that users will copy and run the command directly.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 92% confidence
Finding: This search example uses npx clawhub search "web search" without a version pin, exposing users to execution of the latest remote package. That creates avoidable supply-chain risk, especially for a command likely to be run interactively by users following documentation. While there is no sign of malicious intent, the instruction is operationally unsafe.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 92% confidence
Finding: The unpinned npx clawhub search "weather" command can cause users to execute a newly published or tampered package version. npx convenience comes at the cost of runtime trust in the npm registry state, which is inappropriate for security-conscious guidance. In documentation, repeated unsafe examples normalize risky behavior.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 92% confidence
Finding: The command npx clawhub search "document" references a package without constraining its version, allowing registry-side changes to alter what code is executed. This is a valid supply-chain vulnerability pattern because the skill is directly instructing execution, not merely mentioning the tool by name. Context does not reduce risk here; discovery tasks do not require unpinned execution.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 92% confidence
Finding: npx clawhub search "tavily" is another instance of remote package execution without version pinning. A compromised package release could execute arbitrary code with the privileges of the invoking user. Since the skill repeats this pattern across multiple examples, it amplifies the chance of unsafe copy-paste use.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 92% confidence
Finding: The example npx clawhub search "github" is vulnerable for the same reason: it trusts the latest package version at execution time. This enables package takeover, malicious republishing, or dependency compromise to translate into code execution. The skill is instructional, so the risk is actionable and user-facing.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 92% confidence
Finding: The command npx clawhub search "calendar" remains an unpinned npx execution path. Although the functionality is harmless in intent, the delivery mechanism can execute unexpected code if the npm package changes. This is especially relevant in ecosystems where typosquatting and account compromise are common.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 91% confidence
Finding: npx clawhub search --sort installs pulls and runs an unpinned package, which is a supply-chain risk regardless of the CLI arguments used. Sorting by installs does not change the threat model; the danger comes from executing registry-resolved code without version control. The context of a search utility makes the command easy for users to trust and run.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 91% confidence
Finding: The npx clawhub search --sort stars example also executes an unpinned npm package. This creates a realistic avenue for arbitrary code execution through package compromise or malicious updates. The issue is more dangerous because the skill repeatedly endorses the pattern, reinforcing insecure operational habits.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.