Green Wood Spoon Carving Basics

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 4:18 AM UTC
• Version: 1.0.0

Overview

This is a coherent spoon-carving guidance skill with a supply-chain caution around its unpinned npx install command.

Before installing, prefer a trusted or pinned ClawHub installer if available and avoid running the npx command in a shell with unnecessary secrets. If you use the skill, only provide GPS/photos you are comfortable storing in local project files, and keep the agent's filesystem tracking limited to the carving workspace.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:19

Finding

Unpinned Package Execution Through npx

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 19–25
Vulnerability Type: Unpinned third-party package execution
Risk Level: Medium

Vulnerable Code

yaml

metadata:
  category: skills
  tagline: >-
    Turn fresh-cut branches into heirloom-quality spoons and utensils that last decades — agent owns the species math and schedules so you stay in the knife work and grain reading.
  display_name: "Green Wood Spoon Carving Basics"
  submitted_by: HowToUseHumans
  last_reviewed: "2026-03-31"
  openclaw:
    requires:
      tools: [filesystem]
    install: "npx clawhub install green-wood-spoon-carving-basics"

The same unpinned installation command is repeated in the document body:

text

npx clawhub install green-wood-spoon-carving-basics

Technical Analysis

The installation instructions invoke clawhub through npx without specifying an audited package version or integrity digest. Depending on the local npm configuration and cache state, npx can download the current registry version of the package and execute its code. The effective code executed by this command can therefore change after the skill has been audited.

The target skill name is also not version-pinned in the installation command. No lockfile, package integrity hash, trusted source declaration, or signature-verification procedure is provided. Consequently, compromise of the relevant registry account, package namespace, distribution infrastructure, or a future package release could introduce code not represented in this repository.

Attack Path

1. An attacker compromises the publishing account, registry package, package namespace, or release process associated with clawhub or the requested skill.
2. The attacker publishes a malicious or modified release under the expected package name.
3. A user follows the documented npx clawhub install green-wood-spoon-carving-basics instruction.
4. npx ...[truncated 950 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the CLI to a specifically reviewed version, for example npx clawhub@<audited-version> ..., rather than resolving the latest available release.
• Pin the installed skill to an immutable version or content digest if the installer supports it.
• Use a lockfile and verify registry-provided integrity hashes before execution.
• Document the expected official registry and source repository to reduce dependency-confusion and namespace-substitution risks.
• Prefer a preinstalled, organization-approved CLI instead of implicitly downloading and executing a package during installation.
• Verify package signatures or provenance attestations where supported.
• Run installation with least privilege in a restricted environment, without unnecessary secrets or sensitive environment variables.
• Disable or audit dependency lifecycle scripts where operationally possible.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The skill instructs installation via npx clawhub install ... without pinning a specific version of the package/tool being executed. Because npx fetches and runs code at execution time, a compromised, typosquatted, or newly published malicious version of clawhub could execute arbitrary code on the user's system.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

This repeated npx clawhub install ... command again relies on an unpinned package resolution path, which can cause users to execute whatever version is current at the time. That creates a supply-chain execution risk: an attacker who gains control of the package or dependency path could run arbitrary code during installation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.