Security audit

Proxy

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly coherent for VPN diagnostics, but its setup instructions can update all installed skills through a mutable latest-channel installer, which is broader than its stated purpose.

Review before installing. The VPN workflow itself is disclosed and includes consent gates, but avoid running the documented `update --all` command unless you intend to update every installed skill. Prefer pinned, reviewed versions of the ClawHub CLI and dependencies, and run network-routing changes only from a least-privileged environment you control.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:42
Finding: Execution of Unpinned, Mutable Third-Party Dependencies
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: SKILL.md:49
Finding: Unnecessarily Broad Update of Unrelated Installed Skills
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (9)

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The skill instructs users to execute npx -y clawhub@latest install ..., which fetches and runs the latest published package version at execution time rather than a reviewed, fixed version. That creates a supply-chain risk: if the package or one of its release channels is compromised, users may execute attacker-controlled code during installation of a networking/VPN orchestration skill.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: This line repeats the use of npx -y clawhub@latest, causing runtime retrieval and execution of an unpinned package. Because the skill manages network routing and invokes shell tooling, compromise of the fetched package could directly lead to system command execution or credential exposure.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: Using npx -y clawhub@latest here exposes users to the same unpinned package execution risk. In the context of installing a WireGuard-related component, a compromised package could alter network configuration guidance or run arbitrary code with the privileges of the invoking user.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: This installation command again relies on @latest, which is mutable and can change after the skill is reviewed. Since the skill interacts with Tailscale and network controls, supply-chain compromise could be especially damaging by enabling unauthorized routing changes, data interception, or persistence via shell execution.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: This line instructs execution of an unpinned clawhub@latest package to install the dns skill. Although presented as a documentation convenience, it still results in arbitrary code execution risk from a mutable upstream package source.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The command uses a floating @latest package version, making the executed installer non-deterministic and vulnerable to upstream compromise. Because the skill later relies on geo-attestation and external API integration, a malicious package could tamper with verification logic or exfiltrate tokens.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: This instruction fetches and executes clawhub@latest to install moltguard, creating a classic supply-chain exposure. The risk is amplified because MoltGuard is framed as a security guardrail; compromise of the installer could undermine the very trust boundary users rely on and silently weaken or bypass protections.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 96% confidence
Finding: The npx -y clawhub@latest update --all command is particularly risky because it updates all installed skills from a mutable latest channel in one step. If the upstream package or registry path is compromised, this could mass-update trusted tooling to malicious versions without deterministic review.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 90% confidence
Finding: Even the verification step references npx -y clawhub@latest list, which still causes execution of a mutable package rather than a fixed binary. While lower impact than install/update, it preserves the same supply-chain execution risk and normalizes unsafe package-fetch behavior throughout the skill.
Content: No source excerpt is available for this finding.