Web Hosting

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:16 PM UTC
• Version: 1.0.0

Overview

The skill’s deployment purpose is coherent, but its install path uses unpinned runtime package execution and a broad update-all command before high-impact hosting and repository actions.

Review carefully before installing. Prefer pinned, reviewed versions of ClawHub tooling, avoid `update --all`, and run deployment with least-privilege GitHub, Vercel/Netlify, Maton, and DNS credentials. Expect the skill to create or modify repositories, deployments, CI/CD links, and optional domain records.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:35

Finding

Unpinned Third-Party Tool Execution and Overbroad Skill Updates

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 35–43
Vulnerability Type: Supply-chain exposure through mutable dependencies
Risk Level: Medium

Vulnerable Code

bash

npx -y clawhub@latest install github-api
npx -y clawhub@latest install vercel
npx -y clawhub@latest install netlify
npx -y clawhub@latest install domain-dns-ops
npx -y clawhub@latest install api-gateway
npx -y clawhub@latest update --all

Technical Analysis

The documented commands use npx -y clawhub@latest, which downloads and executes the package version currently associated with the mutable latest tag. The project provides no lockfile, integrity hash, signature requirement, or fixed package version to ensure that the executed package is the same version that was previously reviewed.

Although the skill documentation identifies inspected versions of its upstream skills, the installation commands do not pin those versions. Consequently, users may install later and materially different releases without an intervening security review.

The update --all command further expands the trust boundary by updating every installed skill rather than only the dependencies required by this skill. This can modify unrelated Agent capabilities and increases exposure to compromised, malicious, or unexpectedly changed upstream components.

Attack Path

1. An attacker compromises the clawhub npm package, its publishing account, the mutable latest release, or an upstream skill release.
2. A user follows the installation instructions in SKILL.md.
3. npx retrieves and executes the attacker-controlled or unexpectedly modified package without an interactive confirmation because of the -y option.
4. The installation process installs modified skills or performs malicious package lifecycle behavior with the privileges of the invoking user.
5. If update --all is executed, unrelated installed skills may also be replaced with unreviewed versions.
6. The compromised pac ...[truncated 715 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace clawhub@latest with an exact, reviewed version:

   bash

   npx -y clawhub@<reviewed-exact-version> install ...
   

2. Pin each installed skill to the exact versions recorded as inspected, where the CLI supports version selection.
3. Verify npm package integrity through a committed lockfile, trusted registry configuration, integrity hashes, or package signatures.
4. Remove npx -y clawhub@latest update --all from the standard installation workflow.
5. Update only the explicitly required skills, one at a time, after reviewing their version changes.
6. Run installation with the least-privileged account available and avoid exposing unrelated credentials to the installation process.
7. In controlled environments, mirror approved package artifacts in a trusted registry and permit only reviewed versions.
8. Document a review and rollback procedure for dependency upgrades.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This markdown/manifest description says to use the skill whenever users 'want to make a local site live,' which is a broad natural-language condition rather than a specific trigger phrase or bounded invocation context. The file does not provide explicit negative examples or narrow trigger constraints, so the activation scope could overlap with common deployment-related requests more broadly than intended.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The skill instructs users to run npx -y clawhub@latest ..., which fetches and executes the newest package version at runtime instead of a pinned, reviewed release. In a user-invocable deployment skill that handles repository creation, hosting, and potentially DNS/infrastructure actions, a compromised or breaking upstream release could lead to arbitrary code execution, credential exposure, or unauthorized deployment changes.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

This command executes clawhub@latest without version pinning, creating a supply-chain risk where the behavior can change between runs or a malicious package update can be executed immediately. Because this skill is meant to orchestrate authenticated GitHub and hosting operations, the blast radius includes source code, deployment targets, and linked accounts.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

Using npx with clawhub@latest causes unreviewed remote code to be downloaded and run on demand. In this context, the skill is specifically designed for deployment automation, so an upstream compromise could alter deployment commands, exfiltrate tokens, or tamper with repositories and production URLs.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The unpinned @latest reference exposes users to registry-side supply-chain compromise and non-deterministic behavior. Since the skill may coordinate domain and infrastructure-related tasks, executing a newly published version without review could lead to unauthorized DNS, hosting, or repository modifications.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

This instruction again relies on clawhub@latest, making the executed code mutable over time and vulnerable to package compromise. The danger is elevated by the skill's ability to interact with authenticated services and publish code to production, which amplifies the consequences of arbitrary code execution.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The update command explicitly requests the latest package and then updates all related skills, compounding supply-chain exposure by broadening the amount of newly fetched code. If a malicious or faulty release is published, this could silently alter the toolchain used for GitHub, hosting, and optional DNS/API operations.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence

Finding

Even the verification step uses clawhub@latest, which still downloads and executes whatever version is current at the time. While this specific command may appear lower risk than install or update operations, it still creates an execution path for unreviewed code in an environment likely containing deployment credentials.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.