Natural Earth Pigment Paint Making Basics

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 4:33 AM UTC
• Version: 1.0.0

Overview

This is a coherent paint-making guidance skill with a standard but unpinned install command that users should treat with normal supply-chain caution.

Before installing, use the normal ClawHub/npm precautions for an unpinned `npx` command: verify the package source and CLI version you intend to run, and avoid running installation commands with elevated privileges. Once installed, expect the skill to ask for local photos or location details and to maintain paint-making logs in the filesystem.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:18

Finding

Unpinned Third-Party Package Is Downloaded and Executed Through npx

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 18
Vulnerability Type: Unpinned and mutable third-party dependency execution
Risk Level: Medium

Vulnerable code snippet:

yaml

install: "npx clawhub install natural-earth-pigment-paint-making-basics"

The same installation command is also presented to users at line 24:

shell

npx clawhub install natural-earth-pigment-paint-making-basics

Technical Analysis

The documented installation procedure invokes clawhub through npx without specifying an audited package version or integrity hash. If the package is not already installed locally, npx can retrieve it from the configured npm registry and execute its command with the privileges of the invoking user.

Because neither the CLI version nor its transitive dependencies are pinned, the code executed at installation time can change after this Skill has been reviewed. A compromised maintainer account, malicious package release, dependency compromise, registry substitution, or unsafe registry configuration could therefore introduce arbitrary executable behavior. npm package lifecycle scripts may also run during package installation unless explicitly disabled.

This is a supply-chain weakness rather than evidence that the currently published package is malicious. The audited project contains only SKILL.md; no embedded scripts, credential access, persistence mechanism, obfuscation, destructive operation, or confirmed data-exfiltration behavior was found.

Attack Path

1. An attacker compromises the clawhub package, one of its transitive dependencies, its publisher account, or the registry used by the victim.
2. The attacker publishes a malicious version or causes the unpinned package name to resolve to attacker-controlled content.
3. A user follows the installation instruction in SKILL.md.
4. npx downloads the currently resolved package version rather than a version reviewed ...[truncated 830 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the installer to a specific, reviewed version, for example by invoking clawhub with an explicit immutable version.
2. Commit and enforce an npm lockfile where applicable so transitive dependency versions are reproducible.
3. Verify package provenance and integrity using registry signatures, checksums, or npm integrity metadata before execution.
4. Use only a trusted, explicitly configured registry and reject unexpected registry overrides.
5. Disable package lifecycle scripts during installation where compatible, then invoke only the reviewed entry point.
6. Perform installation in a sandbox, container, or least-privilege account with restricted filesystem, credential, and network access.
7. Document the expected package publisher, version, digest, and verification procedure directly in SKILL.md.
8. Apply the same hardened, pinned command to both the metadata installation field and the user-facing installation example.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The skill instructs users to run npx clawhub install natural-earth-pigment-paint-making-basics without pinning an exact package version. Because npx resolves and executes code from the registry at install time, a compromised upstream package, typo-squatted dependency, or later malicious update could lead to arbitrary code execution on the user's system.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

This repeated inline command again tells the user to execute npx clawhub install natural-earth-pigment-paint-making-basics without a pinned version, creating the same supply-chain risk. Even though the rest of the skill is about paint-making, the dangerous part is the installation vector: running unpinned remote code can expose the host to arbitrary execution before the skill is ever used.

Content

No source excerpt is available for this finding.