Nutrition Physical Labor

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:41 AM UTC
• Version: 1.0.0

Overview

The skill is mostly coherent nutrition guidance, but it asks for broad filesystem access it does not need and uses a mutable npx install command.

Review before installing. The nutrition content itself is ordinary, but users should prefer a pinned or integrity-verified install, run installation in a constrained environment, remove or narrow filesystem access unless needed, and enable weather or meal-prep reminders only by explicit choice.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:15

Finding

Unpinned Package Execution Through npx

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 15
Vulnerability Type: Unpinned third-party package execution
Risk Level: Medium

Vulnerable Code:

yaml

openclaw:
  requires:
    tools: [filesystem]
  install: "npx clawhub install nutrition-physical-labor"

Technical Analysis

The installation command invokes clawhub through npx without specifying a package version or integrity constraint. If the package is not already available locally, npx can retrieve a mutable release from the configured package registry and execute it with the installing user's privileges.

Because the reviewed project contains no lockfile, integrity hash, vendored package, or registry restriction for this command, the code executed during installation is not fully determined by the audited artifact. A compromised package publisher, registry account, dependency chain, or newly published malicious release could alter the effective installation behavior after this Skill has been reviewed.

Attack Path

1. An attacker compromises the clawhub package, its publisher account, or a transitive dependency used during installation.
2. The attacker publishes a malicious version that becomes the version resolved by the unpinned npx clawhub invocation.
3. A user or platform executes npx clawhub install nutrition-physical-labor.
4. npx downloads the mutable package release and executes its command-line entry point.
5. Malicious package or lifecycle code runs with the privileges of the user performing the installation.

Impact Assessment

Successful exploitation could permit arbitrary code execution under the installing user's account. Depending on that account's permissions and environment, an attacker could read or modify accessible files, steal credentials exposed to the process, alter installed Skills, execute network requests, or establish further persistence. This artifact does not itself demonstrate s ...[truncated 98 chars]

Remediation

View remediation

Remediation Suggestions

• Pin clawhub to a specifically reviewed version rather than relying on the registry's current resolution, for example by using an exact version in the npx package specification.
• Use an integrity-verified lockfile or package hash where the installation system supports it.
• Configure the package manager to use an explicitly trusted registry and reject unexpected registry substitutions.
• Review the pinned package, its transitive dependency tree, command-line entry point, and lifecycle scripts before distribution.
• Disable dependency lifecycle scripts where feasible, or perform installation in a sandbox with restricted filesystem, credential, and network access.
• Update the pinned version only through a controlled review and release process.

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:12

Finding

Filesystem Capability Requested Without a Demonstrated Functional Need

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 12-15
Vulnerability Type: Excessive tool permission
Risk Level: Medium

Vulnerable Code:

yaml

openclaw:
  requires:
    tools: [filesystem]
  install: "npx clawhub install nutrition-physical-labor"

Technical Analysis

The Skill declares access to the filesystem tool, but its documented functionality consists of conversational nutrition guidance, meal planning, hydration advice, agent-state fields, and reminder definitions. The reviewed instructions do not identify a legitimate operation requiring general file reads or writes.

Granting a capability beyond the Skill's demonstrated requirements violates least-privilege principles. Although no malicious filesystem operation appears in the reviewed file, the unnecessary capability increases the consequences of future instruction compromise, dependency compromise, unsafe agent interpretation, or malicious content entering the Skill's execution context.

Attack Path

1. The Skill is installed and receives the declared filesystem capability.
2. An attacker compromises the Skill's dependency or otherwise introduces malicious instructions into its execution context.
3. The malicious instructions direct the agent to invoke the available filesystem tool.
4. The agent reads or modifies files allowed by the tool's permission boundary.
5. Retrieved information may be exposed through agent output or other available channels, while modified files may affect user data or subsequent agent behavior.

Impact Assessment

The obtainable scope is limited by the host platform's filesystem sandbox and the privileges of the agent process. If the tool is unrestricted, accessible user documents, configuration files, local application data, tokens, or Skill files could potentially be read or modified. If the platform already confines the tool to a dedicated directory, the impact is correspondingly reduced ...[truncated 74 chars]

Remediation

View remediation

Remediation Suggestions

• Remove filesystem from the required tools unless a concrete file operation is necessary for the Skill's documented behavior.
• Keep transient nutrition-session state in platform-managed, non-file-backed session storage where possible.
• If persistence is required, replace general filesystem access with a narrowly scoped state-storage capability.
• Restrict any required file access to a dedicated Skill-owned directory and deny access to credentials, user documents, system configuration, and other Skills.
• Prefer read-only access when writes are unnecessary, and validate file names and paths against an allowlist.
• Require explicit user approval before reading or writing user-controlled files, and log filesystem operations for review.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 89% confidence

Finding

The install command uses npx clawhub install nutrition-physical-labor without pinning a specific package version. This creates a supply-chain risk because npx may fetch the latest published package at execution time, allowing a compromised or malicious update to run unexpectedly.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The skill defines automation triggers that depend on local temperature forecasts and recurring schedules, which expands behavior beyond static nutrition advice into persistent monitoring and proactive user prompting. This can create privacy, consent, and scope-creep risks if environmental data or recurring reminders are enabled without explicit user approval and clear platform safeguards.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.