Cattail Mat Weaving Basics

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 4:40 AM UTC
• Version: 1.0.0

Overview

This skill is a disclosed cattail-mat weaving guide with proportionate filesystem use, though its install command should be treated as an unpinned remote CLI execution risk.

Before installing, prefer a pinned and trusted `clawhub` version or an organization-approved install path. If used, limit filesystem access to a dedicated project folder because the skill may store photos/GPS-derived notes, schedules, progress logs, inventory records, and pattern templates.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:15

Finding

Unpinned CLI Package Download and Execution via npx

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 15 and 21
Vulnerability Type: Unpinned third-party dependency execution
Risk Level: Medium

Complete Code Snippet:

yaml

install: "npx clawhub install cattail-mat-weaving-basics"

shell

npx clawhub install cattail-mat-weaving-basics

Technical Analysis

The documented installation command invokes clawhub through npx without specifying a reviewed package version or integrity constraint. If the package is not already available locally, npx can retrieve the current package release from the configured package registry and execute its CLI code.

Because the package version is mutable from the perspective of this audited Skill, the code executed during installation may differ from the code present when the Skill was reviewed. A compromised maintainer account, malicious package release, package takeover, or compromised registry could therefore turn the installation instruction into a supply-chain execution channel.

The project contains no embedded executable scripts, and the audit found no evidence that the Skill author currently controls or intends a malicious package payload. The risk arises from executing an unpinned external dependency.

Attack Path

1. An attacker compromises the clawhub package, its publisher account, or the registry delivery path.
2. The attacker publishes a malicious release under the expected package name.
3. A user follows the installation command in SKILL.md.
4. npx resolves and downloads the mutable package release from the configured registry.
5. The downloaded CLI or associated package lifecycle behavior executes with the privileges of the user running the command.
6. The malicious package can access data and perform operations permitted to that user.

Impact Assessment

Successful exploitation could provide arbitrary code execution under the installing user's account. The resulting ...[truncated 484 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the CLI to a specific reviewed version, for example npx clawhub@<reviewed-version> install cattail-mat-weaving-basics.
• Use an exact version rather than a range or floating distribution tag such as latest.
• Verify the package through a trusted registry and validate package provenance, signatures, or published integrity metadata before execution.
• Prefer installing the audited CLI through a lockfile-backed or organization-approved dependency process, then invoke the verified local binary.
• Disable or ignore dependency lifecycle scripts where operationally possible.
• Run installation with a low-privilege account in a sandbox or container that exposes no unrelated credentials or sensitive files.
• Document the expected package publisher, registry, version, and checksum so users can detect substitution or registry misconfiguration.
• Re-audit the pinned package before intentionally upgrading it.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The skill instructs users to run npx clawhub install cattail-mat-weaving-basics without pinning a specific package version. Because npx resolves and executes remote package code at install time, a compromised upstream package, malicious update, or dependency hijack could cause arbitrary code execution on the user's system.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

This repeated install command again uses unpinned npx clawhub, which fetches and executes the latest available package version. If the package or its supply chain is compromised, users may execute attacker-controlled code simply by following the skill instructions.

Content

No source excerpt is available for this finding.