Chainsaw Tree Work

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:33 AM UTC
• Version: 1.0.0

Overview

This is a coherent chainsaw-safety guidance skill, but it asks for filesystem access it does not need and uses an unpinned npx installer.

Review this before installing. The chainsaw guidance itself is safety-focused, but the publisher should remove the unnecessary filesystem permission and use a pinned or verified install command. Install only in an environment where unnecessary local file access is denied or tightly sandboxed.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:15

Finding

Unpinned npx Package Execution Creates a Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:15
Vulnerability Type: Unpinned third-party package execution
Risk Level: Medium

Vulnerable Code Snippet:

yaml

install: "npx clawhub install howtousehumans/chainsaw-tree-work"

Technical Analysis

The installation command invokes clawhub through npx without specifying an exact package version or integrity constraint. If the package is not already installed locally, npx can retrieve and execute the package resolved by the configured npm registry.

Because resolution is mutable, the code executed during installation may differ from the code reviewed at audit time. Security therefore depends on the continuing integrity of the package publisher, npm account, registry, transitive dependencies, and package lifecycle scripts.

The reviewed file does not prove that the current clawhub package is malicious. The vulnerability is the unsafe, unpinned execution mechanism, which creates a viable supply-chain attack surface.

Attack Path

1. An attacker compromises the clawhub publisher account, package, registry resolution path, or one of its executable dependencies.
2. The attacker publishes a malicious release under the package name resolved by npx.
3. A user or automation system executes:

   shell

   npx clawhub install howtousehumans/chainsaw-tree-work
   

4. npx downloads the attacker-controlled package version because no trusted version or integrity digest is specified.
5. The malicious CLI code or package lifecycle script executes with the privileges of the user running the installation command.

Impact Assessment

Successful exploitation could provide arbitrary code execution under the installer account. Depending on that account's privileges and environment, an attacker could read or alter accessible files, steal environment variables and credentials, modify installed skills, execute additional payloads, or establish ...[truncated 198 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the installer to a specifically reviewed package version, for example:

  shell

  npx --yes clawhub@<reviewed-version> install howtousehumans/chainsaw-tree-work
  

• Enforce package-lock or equivalent integrity metadata and verify registry-provided integrity hashes.
• Prefer a preinstalled, centrally managed, and cryptographically verified CLI rather than downloading executable code at invocation time.
• Disable or tightly control package lifecycle scripts where operationally possible.
• Run installation in a sandbox or unprivileged container with minimal filesystem and network access.
• Use an approved registry and monitor the package and its transitive dependencies for ownership changes, unexpected releases, and known vulnerabilities.

T05 · Unauthorized Access and Privilege Escalation

Note

• Location: SKILL.md:12

Finding

Instruction-Only Skill Requests Unnecessary Filesystem Access

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:12-14
Vulnerability Type: Excessive tool permission
Risk Level: Low

Vulnerable Code Snippet:

yaml

openclaw:
  requires:
    tools: [filesystem]

Technical Analysis

The skill declares a requirement for filesystem access, but its documented behavior consists entirely of providing chainsaw and tree-work safety guidance. No reviewed instruction requires reading, creating, modifying, or deleting local files.

Granting a tool that is not necessary for the stated task violates the principle of least privilege. The declaration does not itself demonstrate malicious filesystem use, but it unnecessarily expands the capabilities available while the skill is active. If the surrounding agent allows instructions or user-controlled content to influence tool calls, that additional capability could be abused to access files unrelated to the skill.

The actual exposure depends on how the host interprets tools: [filesystem]. A path-restricted, read-only implementation would have less impact than unrestricted read/write filesystem access.

Attack Path

1. The skill is installed or activated, and the host grants the declared filesystem capability.
2. Malicious user input, prompt injection, or a future modification to the skill directs the agent to perform a filesystem operation.
3. The agent invokes the filesystem tool under the authority granted to the skill.
4. If the host does not enforce path and operation restrictions, the agent reads or modifies files unrelated to chainsaw safety guidance.
5. Retrieved data may be disclosed through the agent response, or modified files may affect other applications or future sessions.

Impact Assessment

Potentially exposed privileges include reading or modifying files accessible to the agent process. The scope could include user documents, application configuration, local skill data, or credentials stored in read ...[truncated 342 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the filesystem requirement because the current skill is instructional and does not need local file access:

  yaml

  openclaw:
    requires:
      tools: []
  

• If a future feature has a documented filesystem need, grant only the minimum required operation and path.
• Prefer read-only access over read/write access.
• Enforce an explicit path allowlist and deny traversal, symlink escapes, hidden credential directories, and access outside the skill workspace.
• Require user confirmation before accessing user-controlled or sensitive files.
• Add automated manifest validation that rejects capabilities not referenced by a documented workflow.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 80% confidence

Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · SKILL.md (reported line 20)May include surrounding context.

md

Chainsaws kill more recreational users than any other power tool. That's not a scare tactic -- it's the reason every section of this skill starts with what can go wrong before telling you how to do it right. A chainsaw doesn't care how confident you feel. It will cut through your femoral artery in the same fraction of a second it cuts through wood. PPE is non-negotiable. The felling plan is non-negotiable. Knowing when to call a professional is the most important skill in this entire document. If you skip the safety gear because it's hot outside or you're "just making one quick cut," this skill isn't for you yet.

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 80% confidence

Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · SKILL.md (reported line 74)May include surrounding context.

md

-> Tree is leaning toward a building, fence, or structure
-> Tree is hung up in another tree ("widow maker" -- extremely dangerous)
-> Tree is dead and has been standing for a long time (unpredictable
   structural integrity, branches fall without warning)
-> Tree diameter is over 18 inches and you have fewer than 10 felling cuts
   of experience
-> You are not sure about the lean direction

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

The skill metadata includes an install command using npx clawhub without a pinned package version. This creates a supply-chain risk because future or compromised versions of the package could be fetched and executed unexpectedly during installation.

Content

No source excerpt is available for this finding.

Unbounded Output

Medium

• Category: Output Handling
• Confidence: 60% confidence

Finding

Output size or generation rate is not bounded. Unbounded output enables denial-of-service through resource exhaustion, log flooding, or context-window stuffing.

Content

Scanner excerpt · SKILL.md (reported line 301)May include surrounding context.

-> Nothing over 12" diameter until you have at least 5 supervised felling cuts -> Nothing over 18" diameter until you have significant experience -> Nothing that requires more than your bar length without cutting from both sides

text