Natural Plant Dye Making Basics

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 4:28 AM UTC
• Version: 1.0.0

Overview

This is a disclosed natural dyeing guidance skill with some normal craft-safety and install-supply-chain cautions, but no evidence of hidden, destructive, or unrelated behavior.

Before installing, use a trusted or pinned ClawHub installer where possible, keep any dye-batch files in a dedicated project folder, and avoid sharing precise location data unless needed. For the physical workflow, independently verify plant identity, local foraging rules, ventilation needs, and mordant safety before handling plants or hot dye baths.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:12

Finding

Unpinned Package Execution Through npx

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 12 and 20
Vulnerability Type: Supply-chain risk from an unpinned executable dependency
Risk Level: Medium

Vulnerable code:

yaml

metadata:
  openclaw:
    requires:
      tools: [filesystem]
    install: "npx clawhub install natural-plant-dye-making-basics"

shell

npx clawhub install natural-plant-dye-making-basics

Technical Analysis

The documented installation command invokes the clawhub npm package through npx without specifying an exact package version or verifying an integrity digest. If the package is not already available locally, npx can retrieve executable package content from the configured npm registry and run it immediately.

Consequently, the code executed during installation is mutable and is not part of the reviewed project. The audit cannot establish that a future package release, registry response, lifecycle script, or transitive dependency will have the same behavior as the version intended by the skill author. This creates a supply-chain trust boundary in which compromise of the package, maintainer account, registry configuration, or dependency graph could introduce arbitrary executable code.

The project contains only SKILL.md; no bundled scripts or direct evidence of a malicious payload were found. The vulnerability is therefore the unsafe, unpinned execution mechanism rather than confirmed malicious behavior by the current clawhub package.

Attack Path

1. An attacker compromises the clawhub package, one of its executable dependencies, or the account authorized to publish it. Alternatively, a hostile package source is selected through a manipulated npm registry configuration.
2. The attacker publishes a modified package version containing malicious CLI code, an installation lifecycle script, or a malicious transitive dependency.
3. A user follows the instructions in SKILL.md and runs:

...[truncated 1270 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin clawhub to an exact reviewed version instead of allowing mutable resolution:

   shell

   npx --yes clawhub@<reviewed-exact-version> install natural-plant-dye-making-basics
   

2. Verify the selected package version, source repository, publisher identity, and npm provenance before documenting it.
3. Use a lockfile and npm integrity metadata where installation is performed within a managed project.
4. Prefer installing dependencies in a controlled environment and invoking the locked local binary rather than downloading and executing code implicitly on every run.
5. Configure an explicit trusted registry and prevent installation from unexpected user-controlled or environment-controlled package sources.
6. Disable lifecycle scripts where they are unnecessary, for example with --ignore-scripts, after confirming that doing so is compatible with the package.
7. Run installation with a non-privileged account in a sandbox or container that has minimal filesystem, credential, and network access.
8. Document the expected package checksum or signed release provenance and establish a process for reviewing dependency updates before changing the pinned version.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The activation text is broad enough to trigger in generalized scarcity, self-reliance, barter, or craft-production contexts rather than only when a user explicitly wants plant dyeing help. Overbroad activation can cause the agent to engage an unnecessarily specialized skill, leading to inappropriate guidance in adjacent scenarios and increasing the chance of unsafe plant-handling or chemical instructions being surfaced without clear user intent.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

The skill instructs users to run npx clawhub install natural-plant-dye-making-basics without pinning a specific package or version. This creates a supply-chain risk: a later compromised or maliciously replaced package/version could be fetched and executed at install time, leading to arbitrary code execution in the user's environment.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

This repeated unpinned npx clawhub invocation has the same supply-chain exposure as the earlier occurrence. Because npx may download and execute package code on demand, leaving the version unspecified increases the chance of installing a tampered or unexpected release.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The 'When to Use' bullets include expansive triggers such as scarcity, avoiding chemical dependence, refreshing textiles, and operating a micro-business, which overlap with many common lifestyle goals. In practice this can over-trigger the skill outside its narrow domain, causing the agent to recommend handling unknown plants, mordants, or hot dye baths in contexts where the user did not specifically ask for this workflow.

Content

No source excerpt is available for this finding.