Dance Movement

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:33 AM UTC
• Version: 1.0.0

Overview

The dance guidance itself is ordinary, but the skill asks for filesystem access that is not explained by its dance-coaching purpose.

Review this skill before installing because it requests filesystem access that the dance-coaching instructions do not appear to need. Install only if you are comfortable granting that tool authority, and prefer a pinned or otherwise trusted clawhub installer path.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:15

Finding

Unpinned Package Execution Through npx

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 15
Vulnerability Type: Unpinned third-party executable dependency
Risk Level: Medium

Vulnerable Code

yaml

install: "npx clawhub install howtousehumans/dance-movement"

Technical Analysis

The installation command invokes the clawhub npm package through npx without specifying a version or integrity constraint. If the package is not already available locally, npx can retrieve and execute the version currently resolved by the configured npm registry.

Consequently, the executable used during installation may differ from the version reviewed when this skill was published. Compromise of the package, its publishing account, its dependency chain, or the configured registry could cause attacker-controlled code to execute during installation. The skill repository itself does not contain an embedded malicious script; the risk arises from executing an unpinned external dependency.

Attack Path

1. An attacker compromises the clawhub npm package, a transitive dependency, its publisher account, or the package source resolved by the user's registry.
2. The attacker publishes a malicious version that includes install-time or CLI-execution code.
3. A user or automation system runs:

   bash

   npx clawhub install howtousehumans/dance-movement
   

4. Because no package version or integrity value is specified, npx resolves and downloads the attacker-controlled release.
5. npx executes the downloaded CLI under the privileges and environment of the installing user.
6. The malicious process can perform any operation permitted to that user, including accessing readable files, modifying writable files, using available credentials, and making network requests.

Impact Assessment

Successful exploitation permits arbitrary code execution with the privileges of the account running the installation command. The affected scope can include ...[truncated 461 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the CLI to a specifically reviewed version:

   bash

   npx --yes clawhub@<reviewed-version> install howtousehumans/dance-movement
   

2. Record and verify the package integrity hash through a lockfile or an equivalent trusted dependency-verification mechanism.
3. Configure npm to use an explicitly trusted registry and protect publisher accounts with strong authentication and restricted release permissions.
4. Prefer installing the reviewed CLI as a locked project dependency and invoking its local binary rather than allowing npx to download an implicitly selected release at execution time.
5. Run installation with a minimally privileged account in a sandbox or container that has no unnecessary credentials, sensitive filesystem access, or unrestricted network access.
6. Review updates before changing the pinned version, including the package provenance, dependency changes, and published integrity metadata.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The manifest description says to use the skill when someone wants to 'connect with others through physical activity' or 'build body awareness,' which are broad intents that overlap with many non-dance contexts. This makes the activation scope unclear and risks unintended invocation outside dance-specific scenarios.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence

Finding

The install instruction invokes npx clawhub without a pinned version, which makes the resolved package and its transitive code depend on the state of the remote registry at execution time. If the package is compromised, unpublished/republished, or a malicious version is later published, users installing the skill could execute unexpected code.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.