Deep Researcher

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:11 PM UTC
• Version: 1.0.0

Overview

The skill’s research workflow is mostly coherent, but its setup uses unpinned installer commands and a bulk update that can change unrelated installed skills.

Install only if you are comfortable with the setup changing your local ClawHub skills. Prefer pinned, reviewed versions of the ClawHub CLI and each required skill, avoid `update --all`, and use restricted Tavily and Perplexity API keys in an isolated environment where possible.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:30

Finding

Unpinned Third-Party Installation and Unscoped Dependency Updates

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 30–34
Vulnerability Type: Supply-chain risk from mutable third-party dependencies
Risk Level: Medium

Vulnerable Code

bash

npx -y clawhub@latest install deepresearchwork
npx -y clawhub@latest install tavily-search
npx -y clawhub@latest install literature-search
npx -y clawhub@latest install perplexity-deep-search
npx -y clawhub@latest update --all

Technical Analysis

The installation procedure invokes the mutable clawhub@latest npm package and installs Skill releases without pinning them to the versions that were inspected. It also runs update --all, which can update unrelated installed Skills outside this project's dependency scope.

Consequently, the code executed during installation is not necessarily the code previously reviewed. If the npm package, registry account, distribution channel, or an upstream Skill release is compromised or changed, following these instructions may retrieve and execute an unreviewed payload with the invoking user's privileges.

Attack Path

1. An attacker compromises the clawhub npm package, an upstream Skill publisher account, or the relevant package-distribution channel.
2. The attacker publishes a malicious release under the mutable latest reference or replaces an unpinned upstream Skill release.
3. A user follows the documented installation or update procedure.
4. npx downloads and executes the changed clawhub@latest package.
5. The installer retrieves the malicious Skill release, or update --all updates another installed Skill to a compromised version.
6. The malicious dependency executes under the user's account when installed or subsequently invoked.

Impact Assessment

Successful exploitation could provide arbitrary code execution with the privileges of the user running the commands. Depending on that user's access, the payload could read local files and environment variables—including declared API credentials—modi ...[truncated 300 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the clawhub CLI to a specific reviewed version rather than using @latest.
2. Pin each upstream Skill to its reviewed version:
   • deepresearchwork version 1.0.0
   • tavily-search version 1.0.0
   • literature-search version 1.0.3
   • perplexity-deep-search version 1.0.0
3. Record and verify cryptographic integrity hashes or trusted publisher signatures before installation.
4. Remove npx -y where practical so unexpected package retrieval does not proceed without review.
5. Replace update --all with explicit, individually versioned updates limited to required dependencies.
6. Review release diffs and repeat the security audit before changing pinned versions.
7. Run installation and Skill execution in a least-privileged, isolated environment with access only to required files and credentials.
8. Restrict API credentials to the minimum required permissions and avoid exposing unrelated secrets to dependency processes.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (6)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The skill instructs users to install and run clawhub@latest via npx, which fetches and executes whatever package version is current at execution time. This creates a supply-chain risk: a compromised publisher account, malicious update, or unexpected breaking change could lead to arbitrary code execution on the host when the skill is followed.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

Using npx -y clawhub@latest to install tavily-search means the executed installer is not fixed to a vetted version. Because this skill is explicitly user-invocable and intended to orchestrate external tooling, the unpinned executable increases exposure to remote code execution through upstream package compromise or unsafe updates.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The installation command for literature-search executes clawhub@latest, allowing unreviewed code to run during setup. In a research meta-skill that also requires API keys and local tools, this broadens blast radius because a malicious package could access credentials, filesystem contents, or network resources.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The skill directs execution of npx -y clawhub@latest install perplexity-deep-search, which is a classic unpinned package execution pattern. If the package or its dependencies are hijacked, an attacker could execute arbitrary code and potentially exfiltrate the required API keys referenced elsewhere in the skill.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

npx -y clawhub@latest update --all is especially risky because it performs a bulk update of all installed skills using a floating executable version. This amplifies supply-chain impact by changing multiple components at once without review, making compromise or instability harder to detect and contain.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence

Finding

Even the verification step uses npx -y clawhub@latest list, which still executes an unpinned remote package. Although lower risk than installation/update, it remains a code-execution vector and normalizes unsafe operational patterns throughout the skill.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.