Orchard Fruit Trees

• Outcome: Pass
• Latest audit: Sep 15, 2026 · 1:42 AM UTC
• Version: 1.0.0

Overview

This is a gardening guidance skill with a disclosed but improvable install command and no evidence of hidden, destructive, or data-stealing behavior.

Before installing, prefer a pinned or otherwise verified `clawhub` installer and run installation without elevated privileges. If the host enables filesystem-backed state or automated reminders, confirm where orchard notes and schedules are stored and that you can disable or remove them.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:14

Finding

Unpinned Package Execution Through npx

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 14-17
Vulnerability Type: Unpinned third-party package execution
Risk Level: Medium

Vulnerable Code

yaml

openclaw:
  requires:
    tools: [filesystem]
  install: "npx clawhub install orchard-fruit-trees"

Technical Analysis

The installation command invokes clawhub through npx without specifying an exact package version or verifying package integrity. If the package is not already available locally, npx may retrieve and execute the version currently resolved by the configured package registry.

Because the resolved package is mutable after this skill has been reviewed, the command creates a supply-chain trust boundary that is not controlled by the audited repository. A compromised package maintainer account, malicious package release, registry compromise, or dependency-chain compromise could alter the code executed by this installation command.

The audited file does not itself contain a malicious payload, and exploitation depends on compromise or replacement of the externally resolved package. Nevertheless, the command permits externally controlled package code to execute during installation without a version or integrity constraint.

Attack Path

1. An attacker compromises the publishing account, distribution channel, or dependency chain associated with the clawhub package.
2. The attacker publishes a malicious version that includes harmful lifecycle scripts or executable runtime behavior.
3. A user follows the installation instruction:

   bash

   npx clawhub install orchard-fruit-trees
   

4. npx resolves and downloads the mutable package release from the configured registry.
5. The malicious package code executes with the privileges and environment of the user running the installation command.
6. Depending on those privileges, the package could access user-readable files, alter local configuration, steal credentials exposed to the process, or install ...[truncated 643 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin clawhub to an exact, reviewed version rather than relying on the registry's current resolution:

   yaml

   install: "npx --yes clawhub@<audited-exact-version> install orchard-fruit-trees"
   

2. Verify the package against a trusted integrity digest or signed provenance before execution.
3. Document and enforce the expected package registry to reduce dependency-confusion and registry-substitution risks.
4. Use a lockfile where the surrounding installation mechanism supports one, and commit the lockfile and integrity metadata for review.
5. Disable or inspect package lifecycle scripts when feasible before allowing installation in a trusted environment.
6. Run installation with a non-privileged account in a sandbox or container with minimal filesystem, credential, and network access.
7. Establish an update process in which each new package version is reviewed before the pinned version is changed.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The description says to use the skill when someone 'wants to grow fruit,' 'is planting trees on a property,' or 'needs to maintain existing fruit trees,' which are broad natural-language conditions rather than narrow trigger phrases. It does not provide exclusion criteria or negative examples, so the activation scope could overlap with many general home, gardening, or landscaping conversations.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.