Basic Home Repair

• Outcome: Pass
• Latest audit: Sep 15, 2026 · 1:32 AM UTC
• Version: 1.0.0

Overview

This is a plain home-repair advice skill with some install and safety cautions, but no evidence of hidden code, persistence, credential access, or malicious behavior.

Before installing, consider pinning or otherwise verifying the clawhub installer and avoid running the install command with elevated privileges. Use the repair advice only for low-risk tasks you are competent to perform; for electrical work, gas, structural issues, repeated breaker trips, or rental habitability repairs, prefer a licensed professional or landlord process.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:13

Finding

Unpinned Package Execution in Installation Command

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 13
Vulnerability Type: Unpinned third-party package execution
Risk Level: Medium

Vulnerable Code Snippet:

yaml

install: "npx clawhub install howtousehumans/basic-home-repair"

Technical Analysis

The installation command invokes clawhub through npx without specifying an exact package version or an integrity constraint. If the package is not already available in the local environment, npx can retrieve package code dynamically from the configured package registry and execute it with the privileges of the installing user.

Because the resolved package can change after this Skill has been audited, the effective installation code is not immutable. Compromise of the package publisher, registry account, distribution channel, or a subsequently published package version could cause the command to execute code that was not present during this review.

This is a supply-chain weakness rather than evidence that the currently referenced package is malicious.

Attack Path

1. An attacker compromises the clawhub package, its publisher account, or its package distribution channel.
2. The attacker publishes a modified release containing malicious installation or runtime behavior.
3. A user follows the Skill metadata and runs the unpinned npx clawhub install howtousehumans/basic-home-repair command.
4. npx resolves and downloads the package version currently provided by the configured registry.
5. The downloaded package code executes with the installing user's privileges.
6. The malicious code can access resources available to that user, subject to operating-system and environment restrictions.

Impact Assessment

Successful exploitation could permit arbitrary code execution under the account running the installation command. Potential scope includes reading or modifying user-accessible files, accessing environment variables and credenti ...[truncated 413 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin clawhub to an exact, reviewed version rather than allowing dynamic resolution, for example:

   yaml

   install: "npx --yes clawhub@<audited-exact-version> install howtousehumans/basic-home-repair"
   

2. Pin the installed Skill or package to an immutable version, digest, or commit if the installer supports that capability.
3. Verify package provenance through registry signatures, checksums, integrity hashes, or an approved internal package mirror.
4. Record the expected registry and package publisher so a modified registry configuration cannot silently redirect dependency resolution.
5. Review the resolved dependency tree and retain a lockfile or equivalent integrity manifest where supported.
6. Run installation with a non-privileged account in a sandbox or restricted environment, and do not invoke it with administrative privileges.
7. Consider installing a previously verified CLI artifact separately and changing the metadata to invoke that trusted local executable instead of downloading and executing package code on demand.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The install command invokes npx clawhub without pinning a specific version, so whoever installs the skill may execute whatever package version is current at install time. That creates a supply-chain risk: a compromised or malicious future release could run arbitrary code on the installing system.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The 'When to Use' section describes broad situations such as any home repair issue, building maintenance skills, avoiding professionals, or being a new homeowner/renter. It does not define specific trigger phrases, constraints, or exclusion conditions, which makes the invocation scope ambiguous for a markdown skill description.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The skill gives actionable instructions for replacing outlets/switches and mounting heavy objects with only limited safety framing, which could lead inexperienced users to electrical shock, fire risk, or property damage. In this skill's context, the audience is explicitly beginners, which increases the danger because they may overestimate their competence and follow abbreviated instructions in unsafe conditions.

Content

No source excerpt is available for this finding.