Bicycle Maintenance Repair

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 4:16 AM UTC
• Version: 1.0.0

Overview

This bicycle-maintenance skill is a coherent maintenance/logging guide, with the main caution being an unpinned npx install command rather than evidence of malicious behavior.

Before installing, consider running the installer in a least-privileged environment and prefer a pinned, reviewed `clawhub` version if available. The skill will maintain bike-related logs and reminders on the filesystem, so only provide bike, mileage, parts, and repair information you are comfortable storing locally.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:14

Finding

Unpinned Package Execution Through npx Installation Command

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 14–22
Vulnerability Type: Unpinned third-party package execution
Risk Level: Medium

Vulnerable Code

yaml

  openclaw:
    requires:
      tools: [filesystem]
    install: "npx clawhub install bicycle-maintenance-repair"
---
# Bicycle Maintenance & Repair

Keep your two-wheeled income machine running like new. This protocol turns any agent into your personal bike mechanic scheduler and parts researcher while you do the satisfying, embodied work of turning wrenches and test-riding. No more $80 flat repairs or three-day shop waits that cost you deliveries.

`npx clawhub install bicycle-maintenance-repair`

Technical Analysis

The documented installation procedure invokes clawhub through npx without specifying an audited version, lockfile, or package integrity hash. If the package is not already available in the local cache, npx can retrieve it from the configured package registry and execute its CLI or package lifecycle behavior.

Because the selected package release is mutable from the perspective of this repository, the code ultimately executed by the installation command may differ from the code that existed when SKILL.md was reviewed. This creates a supply-chain trust boundary outside the audited artifact. Exploitation would require compromise or malicious control of the relevant package, publisher account, registry resolution, or configured package source.

The repository contains no scripts or embedded executable code demonstrating that the package is currently malicious. The issue is the unsafe, unpinned dependency-execution pattern rather than a confirmed malicious payload.

Attack Path

1. An attacker compromises the clawhub package publisher, publication channel, registry account, or another component involved in resolving the package.
2. The attacker publishes a malicious release under the package name resolved ...[truncated 1126 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the installer to a specific, reviewed version, for example:

   sh

   npx --yes clawhub@<reviewed-version> install bicycle-maintenance-repair
   

2. Record the package and transitive dependency versions in a lockfile and review changes before updating them.
3. Verify package integrity using registry integrity metadata, cryptographic checksums, or signed provenance before execution.
4. Explicitly configure and document the trusted package registry rather than relying on an ambient or user-modifiable registry configuration.
5. Disable or tightly control dependency lifecycle scripts where the installation workflow permits it.
6. Run the installer in a sandbox or least-privileged environment without unrelated credentials, sensitive environment variables, or unnecessary filesystem access.
7. Establish a controlled update process that audits each new installer version before changing the pinned version.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The skill instructs users to run npx clawhub install bicycle-maintenance-repair without pinning a specific package version. Because npx resolves and executes the latest matching package from the registry, a compromised or malicious upstream release could cause arbitrary code execution on the user's machine at install time. The skill context increases risk because this is presented as a routine setup step for a maintenance workflow, making users more likely to copy-paste and trust it.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

This second occurrence repeats the same unpinned npx clawhub install bicycle-maintenance-repair command, again allowing execution of whatever version is currently served by the package registry. If the package, dependency chain, or publisher account were compromised, users could be exposed to arbitrary code execution simply by following the skill instructions. Repetition in the main body further normalizes the unsafe command and increases the chance of execution.

Content

No source excerpt is available for this finding.