ClawHub
Back to skill

Security audit

Handbuilt Pottery Pit Firing Basics

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent pottery-planning skill with expected filesystem logging, but users should verify the unpinned npx installer before running it.

Install only from a trusted ClawHub source, avoid running the npx command with elevated privileges, and review where the agent will write logs and reminders. Be prepared to provide location or soil details for clay and fire-safety planning, and verify local fire, soil-contaminant, and food-safety rules before following the physical protocol.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:15
Finding

Unpinned Remote Package Execution Through npx

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 15–21
Vulnerability Type: Unpinned third-party package execution
Risk Level: Medium

Vulnerable Code

markdown
    install: "npx clawhub install handbuilt-pottery-pit-firing-basics"
---
# Handbuilt Pottery & Pit Firing Basics

Create functional, zero-waste pottery using only local clay, handbuilding techniques, and traditional pit firing — no wheels or electric kilns required. This protocol turns raw earth into waterproof bowls, storage jars, cups, and tools that survive real-world use in unstable times.

`npx clawhub install handbuilt-pottery-pit-firing-basics`

Technical Analysis

The documented installation command invokes the clawhub package through npx without specifying an exact package version, integrity hash, lockfile, or verified source. If the package is not already available locally, npx can resolve it from the configured npm registry and execute the resolved package entry point.

Consequently, the code that runs is not immutable relative to the reviewed skill. A later package release, registry compromise, maintainer-account compromise, dependency compromise, or unsafe registry configuration could cause the same documented command to execute different code. The reviewed project contains no local installer implementation through which the executed behavior can be independently verified.

This finding does not establish that the current clawhub package is malicious. The risk arises because the documentation recommends executing mutable remote supply-chain content without version or integrity controls.

Attack Path

  1. An attacker compromises the package publisher, registry account, package dependency chain, or registry resolution path for clawhub.
  2. The attacker publishes or serves a modified package version containing malicious executable behavior.
  3. A user follows the installation command in SKILL.md.

...[truncated 937 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin clawhub to an exact, reviewed version rather than relying on mutable registry resolution:
    bash
    npx --yes clawhub@<audited-exact-version> install handbuilt-pottery-pit-firing-basics
  2. Document the expected official registry, publisher identity, source repository, and release checksum or signature.
  3. Verify package provenance and integrity before execution, preferably using signed releases or a trusted internal package mirror.
  4. Use a lockfile and integrity metadata where installation is managed through a local project.
  5. Review the package entry point, lifecycle scripts, and transitive dependencies for the pinned release.
  6. Run installation with a non-privileged account in a restricted environment, without unnecessary secrets in environment variables.
  7. Avoid invoking npx with administrator privileges and consider disabling or auditing lifecycle scripts where compatible with the installer.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The phrase 'Use when you need durable, repairable kitchenware, storage jars, tools, or ritual objects made from local clay without electricity, kilns, or commercial supply chains' describes a broad need state rather than a specific trigger. It lacks explicit invocation boundaries or negative examples, which may cause unintended activation for general crafting, survival, or household-replacement conversations.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The skill instructs use of npx clawhub install ... without pinning a specific package/version, which creates a supply-chain risk: a future compromised or typo-swapped package version could be fetched and executed at install time. Because npx commonly downloads and runs code immediately, this can lead to arbitrary code execution on the host running the skill installation.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

This repeated unpinned npx clawhub invocation presents the same supply-chain exposure in user-facing instructions, increasing the chance an operator executes unreviewed remote code. If the referenced package or dependency chain is compromised later, the installation step could execute attacker-controlled code in the local environment.

Content

No source excerpt is available for this finding.

Vague Triggers

Low
Category
Not specified by scanner
Confidence
83% confidence
Finding

The listed conditions include common goals like replacing store-bought items, off-grid living, or building community resilience, which are broad contexts rather than precise activation phrases. Without explicit scope limits, the skill may be invoked in conversations only loosely related to pottery planning.

Content

No source excerpt is available for this finding.