Birch Bark Container Making Basics

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:27 AM UTC
• Version: 1.0.0

Overview

The skill is craft-focused, but it overstates the agent's ability to identify and legally validate birch trees and uses an unpinned npx install command.

Review this skill carefully before installing. Do not rely on it as an authority for tree species, protected status, harvest legality, or ecological safety; verify with local forestry rules and a qualified human source. If installing, prefer a version-pinned, reviewed ClawHub installer path rather than a floating npx command.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:13

Finding

Unpinned Package Execution Through npx

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 13 and 22
Vulnerability Type: Unpinned third-party package execution
Risk Level: Medium

Vulnerable Code

Line 13:

yaml

install: "npx clawhub install birch-bark-container-making-basics"

Line 22:

shell

npx clawhub install birch-bark-container-making-basics

Technical Analysis

The documented installation command invokes the unversioned clawhub npm package through npx. If that package is not already available locally, npx may retrieve and execute the version currently resolved by the configured npm registry.

The project does not pin an exact clawhub version or provide a lockfile, package integrity hash, signature-verification procedure, or trusted-registry constraint. Consequently, the executable dependency may change after this Skill has been reviewed. This creates a supply-chain risk if the package, publisher account, registry resolution path, or a future package release is compromised.

Attack Path

1. An attacker compromises the clawhub package, its publisher account, or the package-resolution infrastructure, or causes an unsafe release to become the version selected by npx.
2. A user follows either installation instruction in SKILL.md.
3. npx resolves and downloads the unpinned package from the configured registry.
4. npm lifecycle behavior or the package executable runs attacker-controlled code.
5. The payload executes under the account and environment of the user who invoked the command.

Impact Assessment

Successful exploitation could permit arbitrary code execution with the invoking user's privileges. Depending on that user's permissions and environment, the payload could read or modify accessible files, access environment variables and credentials, make network requests, install additional software, or alter local development state.

The reviewed repository contains no evidence of privilege escalation or persistence itself. Any practi ...[truncated 143 chars]

Remediation

View remediation

Remediation Suggestions

• Pin clawhub to an exact, reviewed version rather than allowing dynamic resolution, for example:

  shell

  npx --yes clawhub@<reviewed-exact-version> install birch-bark-container-making-basics
  

• Validate that exact release before recommending it, including its package contents, lifecycle scripts, executable entry point, and transitive dependencies.

• Use a trusted registry explicitly and enforce approved registry configuration in managed environments.

• Verify package provenance, signatures, or published integrity metadata before execution.

• Prefer a lockfile-backed installation workflow with integrity-protected dependency resolution where possible.

• Avoid executing newly downloaded packages directly. Install reviewed artifacts in a restricted environment first, then invoke the verified executable.

• Run the installer with least privilege and without unnecessary secrets, credentials, filesystem permissions, or network access.

• Keep the version and integrity information in SKILL.md synchronized with each security review.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (4)

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill claims the agent can identify birch trees from photos/GPS and cross-reference local stands, but it only declares filesystem access. This capability mismatch can cause users to rely on nonexistent identification or geospatial validation, increasing the risk of unsafe or unlawful harvesting decisions based on fabricated or guessed outputs.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence

Finding

The skill instructs users to run npx clawhub install ... without pinning a specific version of the package or installer. That creates a supply-chain risk: a newer or compromised package release could execute unexpected code at install time, and npx commonly fetches and runs packages dynamically.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The documentation says the agent 'owns all tree identification' and will flag protected trees immediately, yet the skill contains no tooling or implementation to do that. This creates dangerous overtrust: users may believe legal/ecological safeguards are being enforced when in reality the agent cannot reliably detect protected species or harvest restrictions.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence

Finding

Repeating the unpinned npx clawhub install command in the body of the skill reinforces the same unsafe installation pattern. If the referenced package or a dependency is hijacked, users may execute attacker-controlled code simply by following the documented setup step.

Content

No source excerpt is available for this finding.