Record Keeping Documentation

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 3:19 AM UTC
• Version: 1.0.0

Overview

This skill provides disclosed record-keeping guidance, with caution needed around sensitive documents and the unpinned install command.

Before installing, prefer a pinned or otherwise verified ClawHub CLI and avoid running the install command with elevated privileges or sensitive environment variables. When using the skill, keep actions user-directed, store sensitive medical, financial, and identity documents in encrypted storage, and do not let an agent broadly scan personal files unless you explicitly choose that scope.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:15

Finding

Unpinned npm Package Execution in Installation Command

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 15–17
Vulnerability Type: Supply-chain risk from an unpinned executable dependency
Risk Level: Medium

yaml

openclaw:
  requires:
    tools: [filesystem]
  install: "npx clawhub install record-keeping-documentation"

Technical Analysis

The installation command invokes clawhub through npx without specifying an exact package version or integrity digest. If the package is not already available locally, npx can resolve, download, and execute a package from the configured npm registry at installation time.

Because dependency resolution is not pinned to a reviewed artifact, the code ultimately executed can differ from the code that existed when this Skill was audited. A compromised registry account, malicious package release, package ownership transfer, or unexpected upstream update could therefore introduce attacker-controlled code into the installation process.

The repository contains no vendored installer implementation, lockfile, checksum, or signature that would allow the dynamically resolved package to be verified against a known-good version.

Attack Path

1. An attacker compromises the publishing credentials, ownership, or release process of the npm package resolved as clawhub, or otherwise influences the package source configured on the victim's system.
2. The attacker publishes a malicious version containing an install hook or malicious command-line implementation.
3. A user follows the installation metadata and runs npx clawhub install record-keeping-documentation.
4. npx resolves and downloads the attacker-controlled version because no exact version is specified.
5. The malicious package executes with the privileges and environment of the installing user.

Impact Assessment

Successful exploitation could provide arbitrary code execution under the installing user's account. Depending on that account's permissions ...[truncated 457 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin clawhub to an exact audited version rather than resolving the latest available release, for example:

   yaml

   install: "npx --yes clawhub@X.Y.Z install record-keeping-documentation"
   

2. Verify the pinned release against an expected integrity hash, signed release, or trusted package provenance before execution.
3. Document the approved npm registry and package publisher so alternate registries or similarly named packages are not accepted silently.
4. Prefer installation through a lockfile-controlled dependency workflow or a locally installed, previously verified CLI instead of downloading executable code at invocation time.
5. Run installation with least privilege and without unnecessary secrets in the environment. Do not execute the command as root or an administrator.
6. Review new package versions and their transitive dependencies before updating the pinned version.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The manifest description says to use the skill whenever someone needs to organize documents, track work hours, document workplace issues, keep medical records, or build a paper trail for any dispute. This is a very wide activation scope and does not clarify what nearby requests should not invoke the skill, increasing the chance of unintended activation for ordinary advice-seeking conversations.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

The install instruction invokes npx clawhub without pinning a specific version or integrity value, so execution behavior can change over time or be influenced by a compromised upstream package. Because npx may fetch and execute remote code at install time, this creates a supply-chain risk for anyone setting up the skill.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The section enumerates many high-level situations such as organizing documents, building a case for a dispute, and protecting against identity theft. Because it does not define activation limits or point out excluded contexts, the trigger scope remains ambiguous and overlaps with many common assistance requests.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.