ClawHub
Back to skill

Security audit

Ai Scam Defense

Security checks for vulnerabilities and agentic risk

Overview

The skill provides coherent anti-scam guidance, but it asks agents to persist sensitive fraud-victim details and trigger follow-ups without clear consent, retention, or deletion controls.

Review this skill before installing if you may discuss real fraud, financial loss, identity theft, or police reports with it. Use it only where persistent memory is private and controllable, and avoid storing report numbers, bank details, payment methods, scammer contacts, or exposed personal information unless you knowingly opt in and can delete it later.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:399
Finding

Persistent Storage of Sensitive Fraud-Victim Information Without Defined Safeguards

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 399-425
Vulnerability Type: Sensitive data persistence without defined protection or retention controls
Risk Level: Medium

Vulnerable Code

yaml
## Agent State

Persist across sessions:

```yaml
defense:
  scam_encountered:
    type: null
    date_discovered: null
    date_occurred: null
    amount_lost: null
    payment_method: null
    personal_info_exposed: []
    scammer_contact_info: []
    evidence_saved: false
  recovery_actions:
    accounts_secured: false
    credit_frozen: false
    ftc_reported: false
    ftc_reference_number: null
    ic3_reported: false
    identity_theft_report_filed: false
    police_report_filed: false
    police_report_number: null
    platform_reported: false
    financial_institutions_contacted: []
    fraudulent_accounts_closed: []
  prevention:
    family_safe_word_set: false
    mfa_enabled: false
    password_manager_in_use: false
    credit_monitoring_active: false
    irs_pin_set: false

Technical Analysis

The skill explicitly instructs the agent to persist incident state across sessions. The proposed state includes financial-loss amounts, payment methods, categories of exposed personal information, scammer contact information, financial institutions contacted, fraudulent accounts, and government or police report identifiers.

The skill does not define:

  • Explicit user consent before persistence
  • Data minimization requirements
  • Encryption at rest
  • Access-control or session-isolation requirements
  • Automatic expiration or retention limits
  • User-controlled inspection and deletion
  • Redaction of report numbers and other case identifiers

This creates an insecure data-handling design. Fraud victims are particularly sensitive users, and the retained fields could reveal their financial status, identity exposure, institutions used, and active ...[truncated 1625 chars]

Remediation
View remediation

Remediation Suggestions

  1. Make all incident processing ephemeral by default.
  2. Require explicit, informed opt-in before retaining any information across sessions.
  3. Persist only minimal workflow status where necessary, such as non-sensitive completion booleans.
  4. Do not persist loss amounts, payment methods, scammer contact details, institution names, fraudulent-account details, or government and police report numbers.
  5. Apply field-level encryption to any sensitive data that must be retained.
  6. Restrict access to the originating user and case through strong tenant and session isolation.
  7. Define a short automatic expiration period and provide immediate user-controlled deletion.
  8. Prevent sensitive state from appearing in application logs, telemetry, analytics, prompts, or unencrypted backups.
  9. Display exactly what will be stored and obtain separate consent before writing persistent state.
  10. Add a documented retention policy and security requirements for any runtime implementing the state schema.

T08 · Insecure Dependencies

Warning
Location
SKILL.md:15
Finding

Unpinned Package Execution Through npx Installation Command

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 15
Vulnerability Type: Mutable third-party dependency execution
Risk Level: Medium

Vulnerable Code

yaml
metadata:
  category: safety
  tagline: >-
    Deepfakes, voice cloning, AI phishing, and fake job offers. How to spot and stop the scams that didn't exist two years ago.
  display_name: "AI Scam Defense"
  submitted_by: HowToUseHumans
  last_reviewed: "2026-03-18"
  openclaw:
    requires:
      tools: [browser, filesystem]
    install: "npx clawhub install howtousehumans/ai-scam-defense"

Technical Analysis

The installation command invokes clawhub through npx without a pinned package version or integrity digest. Consequently, the executable resolved when the command is run may differ from the version present when the skill was audited.

npx can retrieve and execute packages from the configured package registry. If package resolution selects a compromised, malicious, or unexpectedly changed release, code from that release may run with the permissions of the user executing the installation command. The audit found no malicious script inside the current project; the risk arises from the mutable external installation dependency.

Attack Path

  1. An attacker compromises the publishing account, registry entry, or release process for the clawhub package, or a future release becomes malicious.
  2. The attacker publishes a changed package under the version selected by unpinned npx resolution.
  3. A user or automated agent executes:
    shell
    npx clawhub install howtousehumans/ai-scam-defense
  4. npx downloads the currently resolved package rather than a specifically audited version.
  5. Package lifecycle behavior or the invoked CLI executes attacker-controlled code using the installing user's privileges.
  6. The malicious package may access files, environment variables, credentials, or network resour ...[truncated 622 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin clawhub to a specific audited version, for example:
    shell
    npx --yes clawhub@<audited-version> install howtousehumans/ai-scam-defense
  2. Lock the resolved package and transitive dependencies with a reviewed lockfile where the installation architecture permits it.
  3. Verify registry integrity metadata or a cryptographic digest before execution.
  4. Explicitly configure and document the trusted package registry.
  5. Run installation in a restricted sandbox with minimal filesystem, environment-variable, credential, and network access.
  6. Disable or review package lifecycle scripts where possible.
  7. Re-audit the exact pinned package before updating the version.
  8. Remove the declared filesystem capability if it is not required by the skill's actual workflow, reducing the consequences of a compromised installation or runtime dependency.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Missing User Warnings

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill persists highly sensitive data across sessions, including amount lost, personal information exposed, scammer contact info, police report numbers, and identity-theft recovery status, but provides no visible retention notice, minimization guidance, or consent flow. If that state is exposed through logs, other tools, shared devices, or unauthorized access, it could materially worsen fraud, identity theft, and privacy harm.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
92% confidence
Finding

The install instruction uses npx clawhub install howtousehumans/ai-scam-defense without pinning a specific version or immutable digest. That creates a supply-chain risk: a later compromised or malicious package release could be executed by users at install time with no integrity guarantee.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The persistent state schema stores detailed incident, identity, financial, and law-enforcement data in plain-language workflow fields, and those same fields are referenced by automations. In a safety skill focused on scam victims, this context is especially sensitive because it creates a durable profile of victimization and recovery status that could be abused for re-targeting, social engineering, or privacy violations if accessed improperly.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The automation triggers are broad and based on sensitive scam/identity-theft state, with limited guardrails for user consent, context, or false activation. This can cause unsolicited security advice or recovery prompts to appear in later sessions, potentially exposing sensitive context to anyone viewing the conversation and driving actions the user did not explicitly request.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.