ZhenZhen EHS Assistant

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 10:15 AM UTC
• Version: 1.0.0

Overview

This is a markdown-only EHS reference skill with disclosed, purpose-aligned guidance and no hidden execution, persistence, or data access behavior found.

Review the cited regulations against your current jurisdiction and company policy before relying on outputs for real EHS decisions. For installation, prefer a reviewed or pinned ClawHub installer version when available, or inspect and manually place the skill folder.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: README.md:35

Finding

Unpinned npm Package Execution During Installation

Content

View full analysis

Vulnerability Details

File Location: README.md, line 35
Vulnerability Type: Unpinned third-party package execution
Risk Level: Medium

Complete Code Snippet:

markdown

1. Install via ClawHub: `npx clawhub install zhenzhen-ehs-assistant`

Technical Analysis

The documented installation command invokes the clawhub npm package through npx without specifying an exact version, integrity hash, signature, or authoritative package source. Depending on local npm behavior and cache state, npx may retrieve the currently resolved package release and execute its CLI code with the privileges of the installing user.

Consequently, the code executed at installation time can differ from the code originally reviewed. If the package publisher account, registry entry, package release, or a transitive dependency is compromised, malicious code could be introduced into the installation chain. The project itself contains no confirmed malicious scripts; this finding concerns the trust and reproducibility of its documented dependency-execution process.

Attack Path

1. An attacker compromises the clawhub npm package, its publisher account, a transitive dependency, or the package-resolution channel.
2. The attacker publishes a malicious release or causes package resolution to return attacker-controlled code.
3. A user follows the installation command in README.md.
4. npx downloads or resolves the unpinned package and executes its CLI or applicable lifecycle code.
5. The malicious code runs under the installing user's account and can access resources available to that account.

Impact Assessment

Successful exploitation could permit arbitrary code execution with the privileges of the user running the installation command. Depending on that user's permissions and environment, the package could read or modify local files, access user-level credentials or tokens, alter development configuration, install pe ...[truncated 358 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the installer to a specifically reviewed package version, for example:

   bash

   npx --yes clawhub@<reviewed-version> install zhenzhen-ehs-assistant
   

2. Confirm and document the official npm package name, publisher identity, registry, and source repository so users can detect typosquatting or package substitution.
3. Publish package integrity information or signed release artifacts and provide verification instructions before execution.
4. Review the pinned package and its transitive dependency tree for lifecycle scripts, known vulnerabilities, unexpected network behavior, and ownership changes.
5. Where supported, disable unnecessary package lifecycle scripts and install with the least-privileged user account.
6. Preserve the manual installation option and document how users can inspect downloaded files before placing them in the OpenClaw skills directory.
7. Establish a controlled update process so version changes require review rather than automatically executing the latest available release.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (15)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

The README instructs users to run npx clawhub install zhenzhen-ehs-assistant without pinning a specific package version. This can lead to non-reproducible installs and creates a supply-chain risk: if the upstream package or a dependency is compromised or changed unexpectedly, users may execute unreviewed code when following the setup instructions. In this context, the risk is somewhat elevated because installation is the primary onboarding path and users are explicitly told to execute the command.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The entire SOP is written only in Chinese and does not indicate that users may choose another language or locale. Under the stated policy, a skill that effectively requires a specific language without opt-in can be a natural-language policy violation unless the locale constraint is clearly documented and justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The entire skill is written as Chinese-only guidance and assumes a China-specific legal and hiring context, including Chinese laws, provincial certification, and local salary norms, without stating that it is region-specific or offering a language/locale choice. This can violate language/locale policy where skills should not force a specific language or locale absent user opt-in or clear justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This markdown file contains user-facing operational guidance exclusively in Chinese, and there is no indication that the skill supports other languages, offers opt-in language selection, or is limited to a China-specific or Chinese-language context. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The section provides fixed Chinese response scripts for interacting with inspectors and does not indicate that another language may be used based on user preference or context. Under the language/locale policy, prescriptive natural-language guidance can be a violation when it forces a specific language without opt-in or a documented regional justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The document presents all operational instructions exclusively in Chinese and does not indicate that the user can choose another language or that the skill is limited to a Chinese-speaking or region-specific audience. Under the language/locale policy, forcing a specific language without user opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The markdown explicitly lists "多语言支持 | 仅中文", which imposes a fixed language constraint. Under the policy rule for natural-language violations, forcing a specific language without user opt-in or a documented justification can be flagged even in planning documents.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The entire skill is written as a Chinese-only operating SOP for EHS staff, with no indication that users may choose another language or locale. Under the policy rule, forcing a specific language without opt-in can be a natural-language policy violation unless the locale constraint is explicitly documented and justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This markdown skill content mandates a single language for all instructions and examples, and there is no indication that users may choose another language or that the skill is intentionally limited to a Chinese-speaking context. Under the policy rule for language/locale, forcing one language without opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

SQP-3 applies to all file types and covers natural-language policy violations such as forcing a specific language without user opt-in. This SOP consistently uses Chinese throughout and does not indicate that the skill is limited to Chinese-speaking users or provide an option for another language.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The entire skill content is written as a mandatory operating SOP in Chinese and does not indicate that users may choose another language or locale. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is clearly documented and justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This markdown file contains user-facing instructional content exclusively in Chinese, and there is no indication that users may select another language or that the guide is specifically restricted to a Chinese-speaking audience. Under the policy rule, forcing a specific language without user opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This markdown file contains natural-language instructions exclusively in Chinese, and there is no statement that the skill is region-specific or that users may choose another language. Under the language/locale policy rule, forcing a specific language without user opt-in is a policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

This markdown file is written entirely in Chinese and does not provide any opt-in, alternative language, or note that the skill is region- or language-specific. Under the stated policy, forcing a specific language without user choice can be a natural-language policy violation unless clearly justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This file contains user-facing operational guidance exclusively in Chinese, and there is no indication that the skill offers locale or language selection. Under the natural-language policy check, forcing a single language without user opt-in can be a policy concern unless the locale constraint is explicitly documented and justified.

Content

No source excerpt is available for this finding.