ClawHub
Back to skill

Security audit

Bookkeeper

Security checks for vulnerabilities and agentic risk

Overview

The skill's bookkeeping purpose is coherent, but its install/update instructions use mutable unpinned packages and an unrestricted bulk update command in a finance and email automation context.

Review the install steps before using this skill. Prefer pinned, reviewed versions of clawhub and the four required skills, and avoid running update --all in an environment with production Gmail, Stripe, OCR, or Xero credentials. Use least-privilege accounts and keep auto-posting on manual review unless you are comfortable with the configured accounting controls.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:24
Finding

Unpinned Third-Party Installer and Unrestricted Bulk Skill Updates

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 24–36
Vulnerability Type: Insecure third-party dependency installation and updates
Risk Level: Medium

Vulnerable Code

markdown
- `gmail` (inspected latest: `1.0.6`)
- `deepread-ocr` (inspected latest: `1.0.6`)
- `stripe-api` (inspected latest: `1.0.8`)
- `xero` (inspected latest: `1.0.4`)

Install/update:

```bash
npx -y clawhub@latest install gmail
npx -y clawhub@latest install deepread-ocr
npx -y clawhub@latest install stripe-api
npx -y clawhub@latest install xero
npx -y clawhub@latest update --all
text

### Technical Analysis

The documentation identifies specific inspected Skill versions but does not install those versions. Instead, every command invokes the mutable `clawhub@latest` npm release and installs each Skill without an explicit version constraint.

The `npx -y` option automatically downloads and executes the selected npm package without interactive confirmation. Consequently, the installer code executed in the future may differ from the version available when this Skill was audited. The absence of documented integrity verification, such as a trusted digest or signature, prevents users from confirming that downloaded installer and Skill artifacts match reviewed content.

The final `update --all` command further expands the modification scope beyond the four declared dependencies. It may update unrelated installed Skills to versions that were not reviewed as part of this project. This violates least-change supply-chain practice and makes the effective runtime dependency set non-reproducible.

This finding does not establish that the current upstream packages are malicious. The vulnerability is the unsafe use of mutable, automatically executed dependency channels and an unrestricted bulk update operation.

### Attack Path

1. An attacker compromises the npm account, publication pipeline, registry delivery path, or mutable release of `clawhub`.
2. Alternatively, an ups
...[truncated 1362 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin the clawhub npm package to an exact, reviewed version rather than using @latest.
  2. Pin all four Skills to their exact inspected versions:
    • gmail version 1.0.6
    • deepread-ocr version 1.0.6
    • stripe-api version 1.0.8
    • xero version 1.0.4
  3. Use only version-installation syntax officially supported by ClawHub; verify that the resolved artifact exactly matches the intended version.
  4. Validate downloaded artifacts using trusted cryptographic hashes, signatures, provenance attestations, or a lockfile where supported.
  5. Remove npx -y clawhub@latest update --all. Update only explicitly named dependencies after reviewing the proposed versions and changes.
  6. Avoid unattended execution of newly downloaded installer code. Retrieve and inspect the intended package version before execution where operationally practical.
  7. Run installation and update operations from a least-privileged account without production credentials in its environment.
  8. Test dependency upgrades in an isolated environment before promotion to a bookkeeping environment.
  9. Document the exact approved dependency set and periodically re-audit each dependency before changing its pinned version.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (6)

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The skill instructs operators to install and update tooling via npx -y clawhub@latest, which pulls mutable code at execution time without pinning an exact version. If the upstream package is compromised or a breaking/malicious release is published, users could unknowingly execute attacker-controlled code in a workflow that has access to API credentials and financial data.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

This line repeats the same unsafe pattern of invoking a mutable remote package via npx ... @latest to install a dependency. Because this bookkeeping skill requires privileged integrations and secrets, executing an unpinned package materially increases supply-chain risk and could expose mail, invoices, payment, and accounting systems.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

Using npx -y clawhub@latest install stripe-api allows whatever code is currently published under that tag to run locally with user trust. In a finance-oriented automation skill, this is especially dangerous because the surrounding environment likely contains payment and accounting credentials that a compromised package could misuse or exfiltrate.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

This installation command again depends on an unpinned @latest package, creating a classic supply-chain execution risk. Because the skill orchestrates Xero access and accounting writes, compromise here could lead not just to code execution but also fraudulent record manipulation or data theft.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
97% confidence
Finding

npx -y clawhub@latest update --all is the most dangerous variant because it instructs bulk updating all installed components from mutable latest sources. That expands the attack surface substantially and can introduce unreviewed changes across multiple integrations at once, undermining reproducibility and making compromise harder to detect.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill directs scanning Gmail contents and sending invoice attachments to an external OCR service, but it does not prominently require explicit user consent or provide a clear privacy/data-handling warning at the point of collection and transfer. Since invoices and emails often contain sensitive financial and personal data, users may unknowingly authorize broad mailbox access and third-party data disclosure.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.