Ask a Chargeback Nerd

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 4:15 AM UTC
• Version: 1.0.0

Overview

This is a markdown-only chargeback guidance skill with no hidden execution, persistence, credential access, or automatic filing behavior, though users should verify its financial dispute guidance before acting.

Before installing, note that the skill gives financial dispute drafting help, not guaranteed legal or banking advice. Verify deadlines, reason codes, and evidence requirements with your card issuer or payment platform, do not submit unsupported claims, and prefer a pinned or otherwise verified ClawHub installer instead of relying on `@latest` when possible.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: README.md:40

Finding

Unpinned Package Execution During Installation

Content

View full analysis

Vulnerability Details

File Location: README.md, lines 40–42
Vulnerability Type: Mutable third-party installer dependency
Risk Level: Medium

bash

npx clawhub@latest install howie-ge/chargeback-assistant

Technical Analysis

The documented installation command uses the mutable npm distribution tag latest and executes the resolved clawhub package through npx. The repository does not pin the installer to an audited version or verify its integrity, signature, or retrieved artifact.

Because latest can resolve to a different package release over time, the installation behavior is not constrained to the content reviewed in this audit. If the upstream package, publisher account, or package-distribution infrastructure is compromised, a subsequent installation could execute changed or malicious package lifecycle and installer code.

Attack Path

1. An attacker compromises the clawhub npm publisher account, the package itself, or a relevant distribution channel.
2. The attacker publishes a malicious release and assigns it the latest tag.
3. A user follows the installation command in README.md.
4. npx retrieves the attacker-controlled release selected by latest.
5. Package lifecycle or installer code executes with the invoking user's operating-system permissions.
6. The malicious installer can access or alter resources available to that user.

Impact Assessment

Successful exploitation could allow arbitrary code execution with the privileges of the user running the installation command. Depending on that user's permissions, the affected scope could include local files, environment variables, credentials accessible to the process, agent configuration, and installed project artifacts.

The repository itself contains no demonstrated malicious executable payload. The risk arises from executing a mutable, externally maintained installer without version or integrity constraints.

Remediation

View remediation

Remediation Suggestions

• Replace the mutable latest tag with an exact installer version that has been reviewed, for example clawhub@X.Y.Z.
• Document the expected package digest or npm integrity value and provide a verification procedure before execution.
• Prefer a signed release or another provenance-verifiable distribution mechanism.
• Review the pinned installer's source code and package lifecycle scripts before recommending execution.
• Update the pinned version only through a controlled dependency-review process.
• Where practical, execute installation with least privilege in an isolated environment and avoid exposing unrelated credentials or sensitive environment variables.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The README promotes generating dispute letters, reason-code mapping, evidence checklists, and deadline guidance for bank chargebacks without warning users to verify the output or treat it as non-legal/non-financial advice. In this context, incorrect or overconfident output could cause users to submit inaccurate claims, miss deadlines, or rely on faulty guidance in a financial dispute process, increasing real-world harm.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The install command uses npx clawhub@latest, which fetches and executes the latest published package version at install time rather than a reviewed, fixed version. This creates a supply-chain risk: if the package is compromised or a breaking/malicious update is published, users may execute untrusted code during installation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The trigger language is intentionally expansive and can activate the skill for vague complaints like 'I was charged for something I didn't get,' even when a chargeback is not the right or lawful remedy. This can steer users prematurely into dispute workflows, increasing the risk of inappropriate chargeback guidance, misuse of financial-dispute processes, and advice that bypasses safer preliminary steps such as ordinary refund resolution.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 101)May include surrounding context.

md

**Cancelled subscription**
- Cancellation confirmation (email, screenshot of cancellation screen)
- If no confirmation: written record of cancellation attempt (date, method used)
- Evidence of continued charges after cancellation date

**Credit not processed**

Static analysis

No suspicious patterns detected.