Besom Broom Making Basics

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 4:38 AM UTC
• Version: 1.0.0

Overview

This broom-making skill is coherent and purpose-aligned, with the main caution being an unpinned installer command and disclosed use of user-provided photos, GPS, reminders, and filesystem logs.

Before installing, consider using a pinned or verified ClawHub installer and run installation with least privilege. When using the skill, share only the photos and approximate location details needed for plant identification, and keep generated logs or dashboards in a scoped project folder.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:15

Finding

Unpinned Package Execution Through npx

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 15 and 20
Vulnerability Type: Unpinned third-party package execution
Risk Level: Medium

Vulnerable Code

yaml

openclaw:
  requires:
    tools: [filesystem]
  install: "npx clawhub install besom-broom-making-basics"

bash

npx clawhub install besom-broom-making-basics

Technical Analysis

The documented installation process invokes the clawhub npm package through npx without specifying a fixed package version or integrity value. Consequently, the code resolved from the package registry at installation time may differ from the version originally reviewed.

An npm package can contain executable entry points and lifecycle scripts. If the upstream package, maintainer account, package registry, or dependency chain is compromised, following this command could execute attacker-controlled code. The project contains no lockfile, vendored installer, checksum, signature, or other mechanism for verifying the resolved package.

This finding concerns the mutable clawhub installer dependency. The audit found no evidence that the broom-making Skill itself contains an embedded malicious payload.

Attack Path

1. An attacker compromises the clawhub package, one of its transitive dependencies, its publisher account, or the package distribution channel.
2. The attacker publishes a malicious package release or replaces an expected dependency with attacker-controlled content.
3. A user follows the installation instruction and runs:

   bash

   npx clawhub install besom-broom-making-basics
   

4. npx resolves and downloads the mutable package version available through the configured npm registry.
5. The malicious package entry point or lifecycle behavior executes with the privileges of the user running the command.
6. The payload can access resources available to that user, subject to operating-system controls and the execu ...[truncated 654 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the installer to a specific reviewed version, for example:

   bash

   npx --yes clawhub@<reviewed-version> install besom-broom-making-basics
   

2. Verify the selected package version and its transitive dependency tree before publishing the installation command.
3. Use a lockfile or equivalent immutable dependency manifest where the installation workflow supports one.
4. Validate package integrity through registry integrity metadata, trusted signatures, or independently published checksums.
5. Configure an explicitly trusted npm registry rather than relying on an uncontrolled registry configuration.
6. Disable or tightly control npm lifecycle scripts where they are not required.
7. Run installation in a sandbox or least-privileged environment without sensitive credentials.
8. Document the exact reviewed installer version and establish a controlled process for reviewing and updating it.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The skill instructs use of npx clawhub install besom-broom-making-basics without pinning an exact package version. This causes execution of whatever package version is current at install time, creating a supply-chain risk where a compromised or maliciously updated package could run arbitrary code on the user's system.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

This repeated unpinned npx clawhub install besom-broom-making-basics command has the same supply-chain exposure: npx may fetch and execute the latest available package version, which can change over time. If the referenced package or one of its dependencies is compromised, users could unknowingly execute attacker-controlled code.

Content

No source excerpt is available for this finding.