Coiled Pine Needle Basket Making Basics

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 4:27 AM UTC
• Version: 1.0.0

Overview

This is a craft-instruction skill whose filesystem use and user-provided photo/GPS inputs fit its basket-making purpose, with only a supply-chain caution around the unpinned installer command.

Before installing, prefer a pinned and trusted ClawHub CLI version or run installation in a low-privilege environment. Be aware the skill asks for location/photos for pine identification and may keep local progress logs or templates.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:15

Finding

Unpinned Third-Party Package Executed Through npx

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:15 and SKILL.md:21
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable code:

yaml

install: "npx clawhub install coiled-pine-needle-basket-making-basics"

sh

npx clawhub install coiled-pine-needle-basket-making-basics

Technical Analysis

The documented installation procedure invokes the third-party clawhub package through npx without specifying an exact, audited package version or an integrity hash. When the package is not already available locally, npx may download and execute the version currently resolved by the configured package registry.

This makes the effective installer mutable after the skill has been reviewed. The project contains no lockfile, integrity metadata, signature verification instructions, or bundled implementation with which the behavior of the installer can be independently audited. A compromised publisher account, package registry, dependency, or newly released malicious package version could therefore turn the documented installation command into a code-execution channel.

Attack Path

1. An attacker compromises the clawhub package, its publisher account, a transitive dependency, or the package source used by the victim.
2. The attacker publishes a malicious version that is selected by the unpinned npx clawhub invocation.
3. A user follows the installation command documented in SKILL.md.
4. npx retrieves the mutable package version and executes its command-line entry point with the user's privileges.
5. Malicious installation code accesses or modifies resources available to that user, potentially including project files, home-directory data, environment variables, credentials, and network-accessible services.

Impact Assessment

Successful exploitation can result in arbitrary code execution under the account running the installation command. The accessible scop ...[truncated 647 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin clawhub to a specific reviewed version rather than allowing registry resolution to select a mutable release, for example:

   sh

   npx --yes clawhub@<audited-exact-version> install coiled-pine-needle-basket-making-basics
   

2. Record and verify the expected package integrity hash or cryptographic signature before execution.
3. Use a trusted, explicitly configured registry and document the expected package publisher and provenance.
4. Prefer downloading the package without executing it, reviewing its contents and dependency tree, and only then invoking the verified artifact.
5. Maintain a lockfile or equivalent reproducible dependency manifest for any executable installer and its transitive dependencies.
6. Run installation in a sandbox or unprivileged container with minimal filesystem access, no unnecessary credentials, and restricted network access.
7. Remove or update both occurrences of the unpinned command in SKILL.md so the metadata and user-facing instructions enforce the same secured installation procedure.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

The skill invokes npx clawhub install ... without pinning an exact package version, so execution depends on whatever version is current at install time. If the package, a dependency, or the distribution channel is compromised, users could run unintended code during installation, which is especially relevant because npx fetches and executes packages directly.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

This repeated unpinned npx clawhub command has the same supply-chain risk: it may pull and execute a newer or tampered package than the author originally intended. Because the command appears in user-facing instructions, it increases the chance that a user will copy-paste and execute remote code without version control or reproducibility.

Content

No source excerpt is available for this finding.