Hosting Feeding Groups

• Outcome: Pass
• Latest audit: Sep 15, 2026 · 1:39 AM UTC
• Version: 1.0.0

Overview

This is a cooking and event-hosting guidance skill with no bundled executable code, though its install command should be treated with normal package-install caution.

Before installing, be aware that the listed install command uses `npx` without a pinned installer version; use a trusted ClawHub installer or a pinned/controlled package source if your environment is sensitive. The skill itself is ordinary hosting and food-safety advice, not a code-running or data-access skill.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:15

Finding

Unpinned npm Package Execution During Skill Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 15
Vulnerability Type: Unpinned third-party package execution
Risk Level: Medium

Vulnerable Code

yaml

openclaw:
  requires:
    tools: [filesystem]
  install: "npx clawhub install hosting-feeding-groups"

Technical Analysis

The installation command invokes the clawhub npm package through npx without specifying an exact package version or integrity hash. If the package is not already available in a trusted local installation, npx may retrieve and execute a mutable version from the configured npm registry.

This creates a supply-chain trust boundary that is not controlled by the reviewed project. The code executed during installation may differ from the code that existed when the skill was audited. Exploitation would require compromise or malicious replacement of the clawhub package, its registry account, a transitive dependency, or the configured package source.

No directly malicious package code was present in the audited project. The risk arises from dynamically executing an unpinned external dependency.

Attack Path

1. An attacker compromises the publishing account, registry entry, package source, or dependency chain associated with the clawhub npm package.
2. The attacker publishes a malicious package version or modifies a dependency used by the package.
3. A user or skill-management system executes:

   sh

   npx clawhub install hosting-feeding-groups
   

4. Because no exact version or integrity value is specified, npx resolves the mutable package version available through the configured registry.
5. The downloaded CLI, package lifecycle hooks, or dependencies execute attacker-controlled code in the installing process.
6. The malicious code operates with the privileges and environment access of the user running the installation command.

Impact Assessment

Successful exploitation could allow arb ...[truncated 609 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the installer to a specific audited version, for example:

   sh

   npx --yes clawhub@<audited-version> install hosting-feeding-groups
   

2. Use a lockfile and verify package integrity through the registry-provided integrity digest or an independently published checksum.
3. Configure and document the trusted npm registry explicitly to reduce dependency-confusion and registry-substitution risks.
4. Prefer a preinstalled, administrator-approved clawhub binary rather than downloading executable code during each installation.
5. Disable or tightly control npm lifecycle scripts where operationally possible.
6. Run installation with a dedicated, least-privileged account in a sandbox or container without unnecessary credentials, sensitive environment variables, or writable access to unrelated files.
7. Establish a controlled update process in which new installer versions and transitive dependency changes are reviewed before the pinned version is advanced.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence

Finding

The install metadata invokes npx clawhub install hosting-feeding-groups without pinning a specific package version. If the upstream package or its dependency chain changes or is compromised, users may fetch and execute unexpected code during installation, creating a supply-chain risk.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The condition "event is tomorrow" is underspecified because it does not define timezone, event date source, or what counts as tomorrow in the skill state. Without precise constraints, the reminder may activate unexpectedly or fail to activate when intended.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The trigger condition "event is in progress" does not define what specific state or signals cause activation, making it unclear when the food safety reminder should fire versus remain inactive. This broad condition could cause unintended invocations in many normal conversation contexts about an event.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.