Land Assessment

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:39 AM UTC
• Version: 1.0.0

Overview

The skill is mainly a land-buying checklist, but it requests unnecessary filesystem access and uses an unpinned npx install command.

Review before installing. The land-assessment content itself is ordinary advisory guidance, but the publisher should remove the filesystem requirement unless a specific file feature is added, and should pin or otherwise integrity-protect the npx install path. Install without elevated privileges and avoid granting broad local file access.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:14

Finding

Unpinned npm Package Execution During Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 14
Vulnerability Type: Unpinned third-party executable dependency
Risk Level: Medium

Vulnerable Code

yaml

install: "npx clawhub install land-assessment"

Technical Analysis

The installation command invokes clawhub through npx without specifying an exact, reviewed package version or integrity digest. Depending on the local npm configuration and cache state, npx can download and execute the package version currently resolved from the configured registry.

Because the resolved package is mutable after this skill has been reviewed, the effective installation code is not fully represented by the audited project. A compromised package maintainer, registry account, package release, or configured registry could cause a future installation to execute attacker-controlled code.

Attack Path

1. An attacker compromises the npm package, its publisher account, or the registry used to resolve clawhub.
2. The attacker publishes a malicious version that is selected by the unpinned command.
3. A user executes npx clawhub install land-assessment as instructed by the metadata.
4. npx retrieves and runs the malicious package or CLI entry point.
5. The payload executes with the operating-system privileges and environment available to the installing user.

Impact Assessment

Successful exploitation could provide arbitrary code execution under the installing user's account. The resulting scope could include access to that user's files, environment variables, credentials available to the process, and network resources. If the command is run with elevated privileges, the impact could extend to system-wide modification.

Exploitation requires compromise or malicious control of the resolved package or registry path; no malicious package code is embedded in the audited project itself.

Remediation

View remediation

Remediation Suggestions

• Pin clawhub to an exact, reviewed version rather than allowing mutable resolution.
• Where supported, validate the package using a trusted integrity digest and a committed lockfile.
• Document the expected registry and reject unexpected registry overrides.
• Review the pinned package, its transitive dependencies, CLI entry point, and lifecycle scripts.
• Disable unnecessary npm lifecycle scripts during acquisition where compatible with the installation process.
• Run installation without administrative privileges and in a restricted environment.
• Establish a controlled update process that requires security review before changing the pinned version.

T05 · Unauthorized Access and Privilege Escalation

Note

• Location: SKILL.md:11

Finding

Filesystem Permission Declared Without a Documented Functional Need

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 11-13
Vulnerability Type: Excessive tool permission
Risk Level: Low

Vulnerable Code

yaml

openclaw:
  requires:
    tools: [filesystem]

Technical Analysis

The skill declares access to the filesystem tool, but its documented workflow consists of conversational guidance, public-record research recommendations, assessment state, and checklists. No instruction in the audited file requires reading or writing local files.

This declaration violates the principle of least privilege by making a local-system capability available beyond the skill's stated operational requirements. The declaration does not itself prove that files are accessed, and the actual scope depends on the host platform's filesystem sandbox and authorization model. Nevertheless, granting an unnecessary capability increases the impact of future malicious changes, instruction injection, or skill compromise.

Attack Path

1. The skill is installed or loaded with its declared filesystem capability approved.
2. A malicious future modification or attacker-controlled instruction causes the agent to invoke that capability.
3. The agent reads, modifies, or creates files within the scope allowed by the host platform.
4. Retrieved information may then be exposed through agent output or used to support further actions.

This path is conditional on the runtime actually granting filesystem access and on malicious or compromised instructions invoking it; the current audited instructions do not direct such access.

Impact Assessment

The maximum impact is bounded by the filesystem scope granted by the host. Potential exposure could include readable user documents, project data, or configuration files. If write access is granted, files within scope could also be altered or created.

There is no evidence in the audited file of attempted file access, credential collection, persistenc ...[truncated 108 chars]

Remediation

View remediation

Remediation Suggestions

• Remove filesystem from the required tools because the documented assessment workflow does not need local file access.
• If a future import or export feature requires files, request access only when that feature is invoked.
• Restrict any future permission to a dedicated application directory rather than the user's general filesystem.
• Prefer read-only access when modification is unnecessary.
• Require explicit user confirmation before reading or writing a selected file.
• Document the exact files, operations, retention behavior, and business purpose associated with any reintroduced filesystem capability.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The skill metadata includes an install command that runs npx clawhub install land-assessment without pinning a specific package version. This allows whatever version is current at execution time to be fetched and run, which creates a supply-chain risk if the package is updated maliciously, compromised, or changed incompatibly.

Content

No source excerpt is available for this finding.