Content Creator

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:11 PM UTC
• Version: 1.0.0

Overview

The skill is mostly a disclosed content-writing orchestrator, but its install instructions use mutable remote execution and a broad update command that can change unrelated installed skills.

Review this skill before installing. Its writing workflow is clear, but prefer pinned ClawHub and skill versions, avoid running update --all, and install only the four required skills from trusted reviewed versions in a least-privileged environment.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:29

Finding

Unpinned Third-Party Package Execution and Overbroad Dependency Updates

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 29-33
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable code:

bash

npx -y clawhub@latest install humanizer
npx -y clawhub@latest install de-ai-ify
npx -y clawhub@latest install copywriting
npx -y clawhub@latest install tweet-writer
npx -y clawhub@latest update --all

Technical Analysis

The documented commands use npx -y clawhub@latest, which retrieves and executes a mutable third-party npm package release without pinning its version or verifying its integrity. The -y option suppresses the normal installation confirmation.

Although SKILL.md identifies the inspected versions of the four upstream Skills, the commands do not pin installations to those reviewed versions. Consequently, users may receive package or Skill content that differs from the versions that were inspected.

The update --all command also exceeds the minimum update scope required by this Skill. It may modify unrelated installed Skills, including components that were not reviewed as part of this project.

Attack Path

1. An attacker compromises the clawhub npm package, its publication credentials, its distribution channel, or a mutable upstream Skill release.
2. A user or agent follows the installation instructions in SKILL.md.
3. npx -y downloads and runs the then-current clawhub@latest package without an interactive confirmation or a pinned version.
4. The compromised package executes with the invoking user's privileges or installs altered Skill content.
5. The altered Skills can subsequently influence agent behavior when invoked.
6. If update --all is used, unrelated installed Skills may also be changed, expanding the affected scope.

Impact Assessment

Exploitation could execute third-party package code with the privileges of the account running npx. The resulting access is bounded by that account's opera ...[truncated 451 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the clawhub npm package to a specific reviewed version instead of using @latest.
2. Pin each upstream Skill to the exact reviewed version listed in the document:
   • humanizer version 1.0.0
   • de-ai-ify version 1.0.0
   • copywriting version 0.1.0
   • tweet-writer version 1.0.0
3. Verify package integrity with registry integrity metadata, checksums, signatures, or provenance attestations where supported.
4. Replace update --all with explicit, version-pinned updates limited to the four required Skills.
5. Require informed user confirmation before downloading or executing third-party installation tooling.
6. Review updated package and Skill contents before deployment, preferably in a sandbox or least-privileged environment.
7. Maintain a lockfile or equivalent dependency manifest so installed artifacts can be reproduced and audited.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (6)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The skill instructs users to execute npx -y clawhub@latest install humanizer, which pulls and runs the latest published package version at execution time rather than a reviewed, immutable version. If the upstream package or publishing account is compromised, users could unknowingly execute attacker-controlled code on their local system.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

This command uses npx -y clawhub@latest install de-ai-ify, which executes whatever code is in the latest published clawhub package at runtime. That creates a supply-chain risk because a malicious or hijacked release could run arbitrary code during installation.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

By recommending npx -y clawhub@latest install copywriting, the skill directs execution of an unpinned remote package version. Unpinned execution increases exposure to malicious updates, dependency confusion, or compromise of the package publisher, leading to arbitrary local code execution.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The command npx -y clawhub@latest install tweet-writer relies on the latest remote package rather than a fixed version, so the actual executed code can change over time without review. In a compromised supply-chain scenario, that could result in unauthorized command execution or system compromise on the user's machine.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

npx -y clawhub@latest update --all is especially risky because it both fetches an unpinned package and performs broad updates, multiplying the number of moving parts introduced into the environment. An attacker controlling the package or one of the updated dependencies could abuse this to deliver malicious code across multiple installed components.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence

Finding

Even the verification step uses npx -y clawhub@latest list, which still downloads and executes the latest package code before listing installed skills. Although the intent appears administrative, the same supply-chain execution risk remains because npx must trust and run mutable remote code first.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.