Product Research

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:16 PM UTC
• Version: 1.0.0

Overview

The skill’s business workflow is mostly clear, but its setup tells users to run unpinned latest tooling and update all installed skills, which is broader than necessary.

Review and pin the ClawHub CLI and each dependency version before installing, remove or avoid `update --all`, and run setup from a least-privileged environment without production API keys. Treat WooCommerce or Shopify actions as live store mutations unless you have confirmed a staging or draft-only path.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:26

Finding

Unpinned Remote Package Execution and Unrestricted Dependency Updates

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 26-34
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code

bash

npx -y clawhub@latest install tavily-search
npx -y clawhub@latest install goplaces
npx -y clawhub@latest install api-gateway
npx -y clawhub@latest install shopify
npx -y clawhub@latest update --all

Technical Analysis

The installation instructions invoke clawhub@latest through npx -y. This causes npm to retrieve and execute the package version currently associated with the mutable latest tag without interactive confirmation. Consequently, the code executed during installation can differ from the version that was reviewed during this audit.

Although the document identifies inspected versions for the individual skills, the commands do not pin those versions. The subsequent update --all operation further replaces every installed skill with its current upstream version, including dependencies unrelated to this skill. No integrity hashes, lockfile, signature verification, allowlist, or post-download review step is specified.

No evidence in the audited files indicates that the current packages are malicious. The vulnerability is the unsafe, mutable supply-chain execution mechanism.

Attack Path

1. An attacker compromises the clawhub publishing account, package registry entry, distribution infrastructure, or one of the named upstream skills.
2. The attacker publishes a modified release and assigns it to the relevant mutable version tag.
3. A user follows the documented installation instructions.
4. npx -y clawhub@latest downloads and executes the changed CLI package without confirmation.
5. The install commands retrieve the compromised skill, or update --all replaces an already inspected dependency with the compromised release.
6. Malicious installation logic or skill content executes with the permissions of the user running ...[truncated 902 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the ClawHub CLI to a reviewed, immutable version rather than using @latest, for example:

   bash

   npx --yes clawhub@<reviewed-version> install tavily-search@1.0.0
   npx --yes clawhub@<reviewed-version> install goplaces@1.0.0
   npx --yes clawhub@<reviewed-version> install api-gateway@1.0.29
   npx --yes clawhub@<reviewed-version> install shopify@1.0.1
   

   The exact syntax should first be verified against the pinned CLI's supported interface.

2. Remove update --all. Update only explicitly named dependencies after reviewing each new version and its changelog.

3. Where supported, validate package signatures or cryptographic checksums before installation. Store expected versions and integrity values in a committed lock or manifest file.

4. Separate download and execution phases. Download packages for inspection first, validate their provenance and contents, and only then install them.

5. Run installation in a sandbox or least-privileged environment without production API keys in its environment. Do not execute package installation as root or an administrator.

6. Require an explicit user confirmation before dependency changes instead of automatically accepting all prompts with -y.

7. Re-audit upstream skills whenever their pinned versions change, particularly skills capable of network access or store deployment.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (7)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The skill instructs users to run npx -y clawhub@latest ..., which fetches and executes the latest published package rather than a reviewed, pinned version. In a supply-chain compromise or malicious upstream update, this could execute attacker-controlled code on the user's machine during install/update flows.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

This line repeats execution of clawhub@latest, again creating an unpinned remote code execution path via npm. Because this skill targets installation of additional tooling and credentials-backed integrations, compromise of the bootstrap package could expose API keys or alter downstream installed skills.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

Using npx with @latest allows whatever version is current at execution time to run locally, which is a classic software supply-chain risk. If the package or one of its publishing accounts is compromised, the user may execute malicious code simply by following the skill instructions.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

This command continues the same unsafe pattern of executing a non-pinned npm package. The danger is amplified because the skill is operational and may be followed by non-expert users who will trust the provided commands without reviewing package changes.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The update command npx -y clawhub@latest update --all is especially risky because it can modify multiple installed components at once using the newest unreviewed package version. This increases blast radius by combining unpinned bootstrap execution with bulk dependency changes.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

Even the verification step uses npx -y clawhub@latest list, which still executes whatever the newest package version is at runtime. Although less dangerous than install/update operations, it remains an unnecessary remote execution vector that could be abused in a package compromise.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The skill describes creating product drafts in WooCommerce or Shopify but does not explicitly warn users that these actions can modify a live store environment. In practice this can lead to unintended publication workflows, data changes, or operational mistakes if a user assumes the actions are read-only.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.