Skill Publisher

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 7:18 AM UTC
• Version: 1.1.0

Overview

This is a straightforward publishing guide for ClawHub skills; its main risk is a user-run, unpinned global CLI install.

Before installing, verify the npm package name and publisher for the clawhub CLI, consider pinning to a reviewed version, and avoid running the install with elevated privileges unless you understand the impact. Review publish parameters carefully because publishing can update an existing skill you own.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:48

Finding

Unpinned Global Installation of a Third-Party CLI Package

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 48
Vulnerability Type: Unpinned third-party dependency installed globally
Risk Level: Medium

Vulnerable Code Snippet:

bash

npm i -g clawhub

Technical Analysis

The publishing instructions recommend installing the clawhub npm package globally without specifying a reviewed version or verifying package integrity. Because an unqualified npm installation resolves to the registry's current release, the effective code installed can change after this skill has been audited.

npm packages may execute lifecycle scripts during installation. If the package, its maintainer account, or one of its transitive dependencies is compromised, following this instruction could execute attacker-controlled code with the privileges of the user running npm. The global installation option also places package files and executable links into global npm locations, increasing the duration and scope of exposure compared with an isolated, task-local dependency.

This issue is conditional on a supply-chain compromise or publication of a malicious package version. The project contains no evidence that the current clawhub package is malicious, and the documented command is not executed automatically.

Attack Path

1. An attacker compromises the npm package, a maintainer account, or a transitive dependency, or otherwise causes a malicious release to become the version resolved by npm.
2. A user follows the prerequisite in SKILL.md and runs npm i -g clawhub.
3. npm downloads the mutable current release and its dependency tree without a project-controlled version or integrity lock.
4. Malicious package contents or lifecycle scripts execute during installation.
5. The installed global CLI can subsequently execute attacker-controlled behavior when the user performs authentication or publishing commands.

Impact Assessment

Exploitation could provide code execution ...[truncated 623 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the CLI to a reviewed version, for example npm install --global clawhub@<reviewed-version>.
• Document the expected npm package name, publisher, registry, and reviewed version so users can detect dependency-confusion or package-ownership anomalies.
• Provide a published integrity hash or a verified provenance/signature workflow where the package ecosystem supports it.
• Prefer a project-local or isolated installation over a global installation when practical.
• Use a lockfile for reproducible dependency resolution if the CLI is incorporated into a managed project.
• Disable lifecycle scripts with --ignore-scripts when they are not required, after confirming that doing so does not prevent legitimate installation.
• Recommend installation under a non-privileged account and explicitly discourage running the command with sudo or administrator privileges.
• Periodically review the pinned package version and its transitive dependency tree before updating the documentation.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The markdown explicitly instructs that SKILL.md should use English because it improves search matching. This is a natural-language locale policy preference that can disadvantage other languages and is not framed as an optional recommendation based on user choice.

Content

No source excerpt is available for this finding.