ClawHub
Back to skill

Security audit

BlogWatcher (Holli)

Security checks for vulnerabilities and agentic risk

Overview

This skill is a simple, disclosed wrapper for installing and using a blog/RSS monitoring CLI, with the main caution being its mutable Go install target.

Install only if you are comfortable running the third-party blogwatcher CLI from GitHub. Prefer a pinned release or commit when possible, and run it with normal user privileges rather than elevated access.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:5
Finding

Unpinned Third-Party Go Dependency

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 5-13
Vulnerability Type: Unpinned mutable dependency
Risk Level: Medium

Evidence

yaml
metadata: {"clawdbot":{"emoji":"📰","requires":{"bins":["blogwatcher"]},"install":[{"id":"go","kind":"go","module":"github.com/Hyaxia/blogwatcher/cmd/blogwatcher@latest","bins":["blogwatcher"],"label":"Install blogwatcher (go)"}]}}
markdown
Install
- Go: `go install github.com/Hyaxia/blogwatcher/cmd/blogwatcher@latest`

Technical Analysis

The installation metadata and documentation direct users to install the third-party Go module with the mutable @latest version selector. Consequently, the source code installed in the future may differ from the version available when this Skill was reviewed.

The package path matches the homepage declared by the Skill, and the audited files contain no evidence of current malicious intent, typosquatting, or dependency confusion. Nevertheless, an upstream account or repository compromise, malicious release, or unauthorized source change could introduce attacker-controlled code. The Skill does not pin a reviewed release or commit and does not provide an independent integrity-verification procedure.

Attack Path

  1. An attacker compromises the upstream repository, release process, or maintainer account for github.com/Hyaxia/blogwatcher.
  2. The attacker publishes a malicious version that Go resolves through @latest.
  3. A user or automated Skill installer executes go install github.com/Hyaxia/blogwatcher/cmd/blogwatcher@latest.
  4. The malicious version is downloaded, compiled, and installed as the blogwatcher executable.
  5. When the user or Agent invokes blogwatcher, the attacker-controlled code executes with the privileges and environment access of that process.

Impact Assessment

Successful exploitation could execute arbitrary code with the privileges of the user or Agent running the insta ...[truncated 481 chars]

Remediation
View remediation

Remediation Suggestions

  1. Replace @latest with a reviewed, immutable semantic version, such as:
    shell
    go install github.com/Hyaxia/blogwatcher/cmd/blogwatcher@vX.Y.Z
  2. For stronger immutability, pin a specific reviewed commit where operationally appropriate.
  3. Verify the expected Go module checksum through the trusted Go checksum database or an organization-controlled integrity policy.
  4. Review source changes and release provenance before updating the pinned version.
  5. Use automated dependency monitoring to identify security advisories without automatically adopting unreviewed releases.
  6. Install and run the CLI with least privilege in a restricted environment that limits access to credentials, sensitive files, and unnecessary network destinations.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.