ClawHub
Back to skill

Security audit

Deliberate Cold Exposure

Security checks for vulnerabilities and agentic risk

Overview

This skill has no hidden code, but it asks an agent to guide risky cold-exposure routines and keep health logs, so users should review it carefully before installing.

Install only if you are comfortable with an agent keeping local health and mood logs and drafting doctor communications from them. Treat the cold-plunge protocol as medical-adjacent fitness guidance, avoid breath-hold or unsupervised natural-water exposure, and seek qualified medical advice before following immersion guidance, especially with any cardiovascular, respiratory, neurological, circulatory, pregnancy-related, or medication-related risk.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T08 · Insecure Dependencies

Error
Location
SKILL.md:16
Finding

Unpinned Package Execution During Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 16–22
Vulnerability Type: T08: Insecure Dependencies
Risk Level: High

Vulnerable Code

yaml
install: "npx clawhub install deliberate-cold-exposure"
shell
npx clawhub install deliberate-cold-exposure

Technical Analysis

The documented installation process invokes clawhub through npx without specifying an exact package version or verifying a package integrity digest. Depending on the local environment and package-manager configuration, npx can retrieve and immediately execute the currently resolved package from an external registry.

The repository contains no lockfile, vendored installer, checksum, signature-verification procedure, or publisher-validation mechanism that would bind installation to the version reviewed during this audit. Consequently, the code executed during installation may differ from the content originally audited.

This creates a supply-chain execution boundary: compromise of the package publisher, registry account, package-resolution process, or a future release could result in arbitrary installer code running on a user's system.

Attack Path

  1. An attacker compromises the package publisher, registry account, or another component of the package distribution path.
  2. The attacker publishes a malicious version that resolves under the unversioned clawhub package name.
  3. A user follows the installation command from SKILL.md.
  4. npx downloads and executes the attacker-controlled package.
  5. Malicious package lifecycle or installer code runs with the privileges of the invoking user.

Impact Assessment

Successful exploitation could provide arbitrary code execution with the current user's privileges. Depending on those privileges and the host configuration, the malicious package could access user-readable files, steal credentials available to the process, alter project files, make network ...[truncated 336 chars]

Remediation
View remediation

Remediation Suggestions

  • Pin clawhub to a specific, reviewed version rather than allowing an unspecified current release to execute.
  • Commit an appropriate lockfile containing package integrity metadata.
  • Verify registry provenance, publisher identity, signatures, and cryptographic integrity before execution.
  • Document the authoritative package registry and expected package digest.
  • Prefer an installation process that downloads and verifies the artifact before executing it.
  • Review package lifecycle scripts and transitive dependencies for the pinned release.
  • Run installation with the minimum necessary privileges and avoid elevated shells.
  • Use automated dependency monitoring while requiring explicit review before changing the pinned version.

other

Error
Location
SKILL.md:56
Finding

Unsafe Cold-Exposure and Breath-Hold Instructions

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 56–70; related safety decision tree at lines 85–93
Vulnerability Type: other: Unsafe medical and physical exposure guidance
Risk Level: High

Vulnerable Code

markdown
- **Duration**: 2–5 minutes full cold plunge (bathtub, stock tank, or natural body of water).
- **Frequency**: 4–6× per week, including one longer weekend session.
- Target water temp: 10–15°C (50–59°F) — agent researches your local options and suggests ice quantity if using home tub (e.g., 20–30 lbs crushed ice for 10°C drop).
- Technique: Enter slowly, submerge to neck, use same nasal breathing. Exit at first sign of uncontrollable shivering.
- Agent: Calculates exact ice needs, tracks cumulative exposure minutes, and generates weekly summary report.

### Phase 4: Maintenance & Mastery (Week 9+)
- 3–5 sessions per week, 3–10 minutes at target temp.
- Optional advanced: outdoor winter plunges or breath-hold walks in cold air.

Technical Analysis

The skill instructs users to progress to neck-deep cold immersion, sessions lasting up to ten minutes, outdoor winter plunges, and breath-hold activity. Personalization is based primarily on self-reported health information and a short decision tree rather than direct clinical evaluation.

Cold-water immersion can trigger an involuntary gasp response, hyperventilation, sudden blood-pressure changes, arrhythmia, impaired motor control, syncope, and hypothermia. Breath-holding can compound the risk of loss of consciousness. In natural water, sudden incapacitation can lead directly to drowning.

Directing users to exit only after uncontrollable shivering may also provide an inadequate stopping threshold because dangerous cold-shock or cardiovascular symptoms can occur before shivering becomes uncontrollable. The presence of a disclaimer and a limited symptom checklist does not make an automated agent capable of establishing medical ...[truncated 1391 chars]

Remediation
View remediation

Remediation Suggestions

  • Remove breath-hold walks and any suggestion to combine breath-holding with cold exposure.
  • Remove or substantially restrict natural-water and outdoor winter plunge instructions.
  • Require individualized clinician clearance before recommending immersion, particularly for users with cardiovascular, respiratory, neurological, circulatory, pregnancy-related, or medication-related risk factors.
  • Do not characterize an agent-generated questionnaire as medical clearance.
  • Restrict general guidance to conservative, non-diagnostic educational information.
  • Define conservative temperature and duration limits and require immediate termination for chest pain, breathing difficulty, confusion, dizziness, numbness, weakness, or loss of coordination—not merely uncontrollable shivering.
  • Require a capable, informed observer for any immersion and prohibit locked rooms, solitary natural-water exposure, and environments from which the user cannot exit immediately.
  • Add emergency-response instructions and advise users to seek urgent medical assistance for persistent or severe symptoms.
  • Have the revised protocol and its health claims reviewed by appropriately qualified medical professionals.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (4)

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The skill instructs users to run npx clawhub install deliberate-cold-exposure without pinning a specific package or tool version. That creates a supply-chain risk because a later malicious or compromised package release could be fetched and executed unexpectedly, and npx commonly downloads and runs code dynamically.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

This is a second unpinned npx clawhub invocation, carrying the same remote code execution and supply-chain exposure as the earlier instance. Repeating the unsafe command in the main body increases the chance that a user will actually execute it.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The skill explicitly collects age, fitness level, medical flags, water temperature, and session logs, then stores them in markdown files via the filesystem tool, but it does not clearly warn users that sensitive health-related data will be retained locally. In this context, the omission is more dangerous because the skill is health-oriented and longitudinal tracking can reveal medical conditions, habits, and wellness status.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The doctor-clearance template says the agent will generate an email containing the full protocol, health data, and session log summary, but the skill does not prominently warn that this may disclose sensitive personal health information. In a medical-adjacent skill, silent inclusion of logs and baseline data raises privacy and unintended-disclosure risks if the message is reviewed, auto-saved, synced, or sent to the wrong recipient.

Content

No source excerpt is available for this finding.