Mushroom Cultivation Basics

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:16 AM UTC
• Version: 1.0.0

Overview

This mushroom-growing skill is mostly coherent, but its install command can fetch mutable code and it asks to persist precise personal growing details without clear retention controls.

Review the install path before running it, preferably using a pinned and trusted ClawHub installer. If installed, only provide coarse location unless exact location is necessary, decide where logs should be stored, and periodically delete or redact cultivation logs that include personal location, health, budget, or sales information.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:15

Finding

Unpinned npm CLI Execution Creates a Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:15 and SKILL.md:21
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code

yaml

openclaw:
  requires:
    tools: [filesystem]
  install: "npx clawhub install mushroom-cultivation-basics"

The same command is repeated in the document body:

text

npx clawhub install mushroom-cultivation-basics

Technical Analysis

The installation instructions invoke clawhub through npx without specifying an exact package version, integrity hash, lockfile, or immutable source. If the CLI is not already available locally, npx may retrieve the current package release from the configured npm registry and execute it with the installing user's privileges.

Because the retrieved version can change after this Skill has been audited, the effective installation code is not bounded by the reviewed project contents. Compromise of the package publisher account, registry entry, or transitive dependency could therefore turn the documented installation command into an arbitrary-code execution channel.

No evidence shows that the current clawhub package is malicious. The finding concerns the mutable and unverified dependency execution mechanism.

Attack Path

1. An attacker compromises the clawhub npm package, its publisher account, or one of its executable dependencies.
2. The attacker publishes a malicious release under the package name resolved by npx.
3. A user follows the command in SKILL.md.
4. npx resolves and downloads the mutable package release from the configured registry.
5. Package lifecycle logic or CLI entry-point code executes on the user's machine.
6. The malicious code operates with the permissions and environmental access of the user running the command.

Impact Assessment

Successful exploitation could execute arbitrary commands with the installing user's privileges. Depending on the e ...[truncated 481 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the CLI to an exact reviewed version, for example:

  text

  npx --yes clawhub@X.Y.Z install mushroom-cultivation-basics
  

• Verify the selected release and its transitive dependencies before documenting it as trusted.
• Use a lockfile and npm integrity metadata where the installation workflow supports them.
• Explicitly identify the expected registry and prevent fallback to untrusted package sources.
• Prefer a trusted, preinstalled CLI or a locally vendored and reviewed installer over runtime retrieval.
• Run installation under a least-privileged account without unnecessary secrets in environment variables.
• Apply the hardened command consistently at both SKILL.md:15 and SKILL.md:21.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Ae4

Medium

• Category: analysis-evasion
• Confidence: 80% confidence

Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 88% confidence

Finding

The install instruction uses npx clawhub install mushroom-cultivation-basics without pinning a specific version of the package manager or referenced package state. This creates a supply-chain risk: future executions may pull changed or compromised code, causing users or agents to install unreviewed content.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 88% confidence

Finding

The repeated npx clawhub install mushroom-cultivation-basics command again relies on an unpinned package resolution path. Even if the current package is safe, later package updates, dependency compromise, or namespace hijacking could turn this into arbitrary code execution during installation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly directs collection of exact location, climate, regulations, and ongoing filesystem-based progress logs without an accompanying data-minimization or retention warning. This can expose sensitive personal information such as precise location, behavioral patterns, and potentially commercial activity details, especially if logs persist across sessions or are accessible to other tools/users.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The 'When to Use' section describes broad life situations such as fragile grocery supply chains, desire for side income, or seeking satisfaction, rather than specific trigger phrases or constrained activation conditions. Because this is a markdown file and no explicit trigger boundaries or negative examples are provided beyond a single capability constraint, the invocation scope is ambiguous and could cause unintended use.

Content

No source excerpt is available for this finding.