Foraging Wild Edibles

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:38 AM UTC
• Version: 1.0.0

Overview

The skill is mostly a coherent foraging guide, but it includes risky advice that could lead someone to test or eat unknown wild plants, plus an unpinned install command.

Review this carefully before installing. Do not use it to decide that an unknown wild plant is safe to eat, and do not rely on the universal edibility test or a single smell-based rule. Use qualified local experts, authoritative regional field guides, and poison-control or emergency services for suspected exposure. If installing, prefer a pinned and verified package source rather than the unpinned npx command.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:13
• Finding: Unpinned Package Execution Through npx<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:13` **Vulnerability Type**: Supply-chain risk from an unpinned executable dependency **Risk Level**: Medium ### Vulnerable Code ```yaml install: "npx clawhub install howtousehumans/foraging-wild-edibles" ``` ### Technical Analysis The installation command invokes `clawhub` through `npx` without specifying an exact package version, integrity hash, lockfile, or trusted artifact digest. Depending on the local npm configuration and cache state, `npx` can download and execute the package version currently published in the configured registry. This creates a mutable execution boundary: the code executed during installation can differ from the code that existed when this Skill was reviewed. Registry-account compromise, malicious package replacement, dependency confusion caused by an untrusted registry, or a compromised transitive dependency could therefore introduce arbitrary executable behavior. The repository itself does not contain evidence that the referenced package is malicious. The finding concerns the unsafe, unpinned execution mechanism. ### Attack Path 1. An attacker compromises the package, its publisher account, a transitive dependency, or the registry used by the victim. 2. The attacker publishes a malicious version that is selected by the unversioned `npx clawhub` invocation. 3. A user follows the installation instruction in `SKILL.md`. 4. `npx` retrieves or resolves the attacker-controlled package version. 5. The package, its entry point, or an installation lifecycle script executes with the privileges of the user performing the installation. ### Impact Assessment Successful exploitation could execute arbitrary commands under the installing user's account. The resulting scope could include: - Reading or modifying files accessible to that user. - Accessing environment variables and locally stored developer credentials. - Modifying project files or user-level configuration. - Maki ...[truncated 357 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Pin `clawhub` to an exact, reviewed version rather than allowing mutable version resolution. - Use a lockfile and verify the package's registry integrity metadata. - Prefer a locally installed, reviewed dependency invoked through a package script instead of downloading an executable at invocation time. - Configure npm to use an explicitly trusted registry. - Disable package lifecycle scripts during installation where compatible with the tool. - Publish and verify a cryptographic checksum or signed provenance statement for the expected package artifact. - Re-audit the pinned package and its dependency tree whenever the pinned version changes. ]]>

other

Error

• Location: SKILL.md:311
• Finding: Unsafe Ingestion-Based Universal Edibility Test<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:311-348` **Vulnerability Type**: Unsafe health and wilderness-survival guidance **Risk Level**: High ### Vulnerable Code ```text UNIVERSAL EDIBILITY TEST — SURVIVAL SITUATIONS ONLY This is NOT a foraging method. This is a last-resort protocol for wilderness survival when you have no knowledge of local plants. It takes 24+ hours and may still fail for some toxins. DO NOT USE THIS IF: - You have any other food source - You're within reach of civilization - The plant has any of the "avoid" characteristics below AVOID ENTIRELY (do not test): - Umbrella-shaped white flower clusters (potential hemlock family) - Plants with milky or discolored sap - Beans, bulbs, or seeds from unknown plants - Plants with an almond scent in leaves or bark (cyanide) - Grain heads with pink, purple, or black spurs (ergot) - Plants with three-leaflet growth pattern (potential poison ivy/oak) THE TEST (8-hour minimum per plant part): 1. Test only one plant part at a time (leaf, stem, root, fruit) 2. Smell: crush and smell. Bitter almond = discard. Strong chemical smell = discard. 3. Skin contact: rub on inner wrist. Wait 8 hours. Any reaction (rash, redness, burning, numbness) = discard. 4. Lip test: touch to your lip for 15 minutes. Any tingling, burning, or numbness = discard. 5. Tongue test: place on your tongue for 15 minutes. Do not swallow. Any bad reaction = spit, rinse, discard. 6. Chew test: chew and hold in mouth 15 minutes. Do not swallow. Any bad reaction = spit, rinse, discard. 7. Swallow test: eat a small amount. Wait 8 hours. No negative effects = probably safe for that plant part. 8. Eat a larger portion. Wait another 8 hours. ``` ### Technical Analysis The protocol directs a user to expose their skin and mucous membranes to an unidentified plant and ultimately ingest it. These tests cannot reliably establish edibility. Plant toxicity may be delayed, cumulative, organ-specific, dose- ...[truncated 1615 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Remove the ingestion-based universal edibility test, including the recommendation to swallow progressively larger portions. - Clearly state that an unidentified wild plant must not be consumed based on smell, taste, contact testing, photographs, or an AI-generated assessment. - In genuine survival scenarios, prioritize rescue signaling, navigation to safety, water, shelter, known carried food, and guidance from trained emergency personnel. - Direct users to authoritative regional field resources and qualified local experts when identification can be performed safely. - If exposure has already occurred, advise the user not to induce vomiting unless directed by a medical professional, to preserve a sample or photographs, and to contact local emergency services or poison control immediately. - Require independent confirmation using multiple diagnostic features and authoritative regional references before discussing preparation or consumption. ]]>

other

Error

• Location: SKILL.md:474
• Finding: Single-Feature Allium Identification Presented as a Guarantee of Safety<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:474-475` **Vulnerability Type**: Unsafe plant-identification guidance **Risk Level**: High ### Vulnerable Code ```text If it looks like wild garlic/onion and smells like garlic/onion, it's safe. If there's no smell, it might be lily of the valley or death camas. Walk away. ``` ### Technical Analysis The statement presents appearance plus garlic or onion odor as a conclusive guarantee that a plant is safe. This is an overbroad identification rule and conflicts with the Skill's earlier instruction to identify plants using at least three or four independent characteristics. Odor is a useful diagnostic feature but is not sufficient by itself to establish species, edible part, safe preparation, lack of contamination, or suitability for a particular individual. Odor can also be transferred between plants during collection or handling, creating additional ambiguity. A categorical statement that the plant “is safe” can cause users to disregard regional lookalikes, harvesting conditions, preparation requirements, allergies, or expert confirmation. ### Attack Path 1. A user encounters a plant that resembles wild garlic or onion. 2. The user crushes or handles it near genuine Allium material and perceives a garlic-like odor. 3. The Agent's categorical safety statement leads the user to treat odor and general appearance as sufficient identification. 4. The user consumes the plant without checking multiple botanical characteristics or obtaining regional confirmation. 5. Misidentification, contamination, an inedible plant part, or another contraindication results in illness or poisoning. ### Impact Assessment The issue does not affect system permissions or provide digital access. The potential physical scope includes one or more users relying on the Agent's advice and suffering: - Toxic plant exposure from misidentification. - Gastrointestinal or systemic poisoning. - Allergic reactions. - Illness cau ...[truncated 107 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Replace the categorical phrase “it's safe” with a statement that garlic or onion odor is only one identification feature and is never sufficient on its own. - Require confirmation using multiple independent characteristics, including leaf structure, growth habit, bulb structure, flowers when present, habitat, and regional range. - Require comparison against region-specific toxic lookalikes using an authoritative field guide or qualified local expert. - Warn users not to consume specimens that have been mixed with other collected plants, because transferred odor can invalidate the smell check. - Retain the conservative instruction not to consume a suspected Allium when the characteristic odor is absent. - Avoid declaring any wild plant safe to eat until identity, edible part, preparation requirements, collection conditions, and individual contraindications have all been addressed. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Harmful Content Injection

Critical

• Category: Prompt Injection

Content

(fritters, cordial, tea)
   SEASON: flowers in spring, berries in late summer
   ID: compound leaves with 5-7 toothed leaflets, flat-topped clusters
     of tiny white flowers, clusters of small dark purple-black berries
   WARNING: raw berries cause nausea. Cook or dry them.
   CRITICAL: do NOT confuse with water hemlock or pokeweed berries

9. CATTAIL (Typha latifolia)
   WHERE: marshes, pond edges, ditches, anywhere with standing water
   PARTS: nearly everything — young shoots (spring, like hearts of palm),
     pollen (flour supplement), rhizomes (starchy, can be processed

• Confidence: 95% confidence
• Finding: This content may contain harmful instructions that could cause physical harm if followed. CRITICAL: Review carefully before use.

Harmful Content Injection

Critical

• Category: Prompt Injection

Content

**Agent action**: These are the ones that kill or seriously injure. Knowing what NOT to eat is more important than knowing what to eat.

```
DEADLY PLANTS TO RECOGNIZE AND AVOID:

WATER HEMLOCK (Cicuta species):
- THE most toxic plant in North America
- Looks like: wild carrot, wild parsnip, elderflower
- Found near water, wet meadows, stream banks
- White umbrella-shaped flower clusters
- DISTINCTIVE: purple-streaked hollow stem, chambered root

• Confidence: 95% confidence
• Finding: This content may contain harmful instructions that could cause physical harm if followed. CRITICAL: Review carefully before use.

Missing User Warnings

High

• Confidence: 95% confidence
• Finding: The skill includes a step-by-step universal edibility test for unknown plants, which is hazardous because many plant toxins are not reliably detected by taste/contact protocols and delayed toxicity can still cause severe poisoning or death. Although the section says it is survival-only, the procedural detail materially enables risky behavior in a domain where text guidance is inherently unreliable.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence
• Finding: The skill references `npx clawhub install howtousehumans/foraging-wild-edibles` without pinning an exact package or artifact version. That creates a supply-chain risk: future upstream changes or compromise of the package name could cause users to install unexpected code when following the install instruction.

Vague Triggers

Medium

• Confidence: 87% confidence
• Finding: The 'When to Use' section is broad enough to trigger on casual plant-identification or food-supplement queries, including wilderness scenarios, without strong exclusion boundaries. In this context, over-triggering is dangerous because the skill gives actionable advice about consuming wild plants, where even small identification mistakes can have serious health consequences.

Static analysis

No suspicious patterns detected.