Soil Water Management

• Outcome: Review
• Latest audit: Sep 16, 2026 · 3:27 AM UTC
• Version: 1.0.0

Overview

The skill is mostly ordinary soil and water gardening guidance, but it asks for broader local filesystem access and uses an unpinned executable install command that users should review first.

Install only if you are comfortable with the ClawHub/npx installation path, preferably from a non-privileged shell with sensitive environment variables minimized. Because filesystem access is declared without a clear need, review or restrict that permission if your OpenClaw environment supports scoped tool access.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:15

Finding

Unpinned npm Package Execution in Installation Command

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:15
Vulnerability Type: Unpinned third-party dependency execution
Risk Level: Medium

Vulnerable Code:

yaml

install: "npx clawhub install soil-water-management"

Technical Analysis

The installation command invokes the clawhub npm package through npx without specifying an exact package version or integrity constraint. If the package is not already available locally, npx can retrieve and execute the package currently published under that name.

Consequently, the code executed during installation is mutable and may differ from the version that existed when this Skill was reviewed. The repository contains no vendored installer implementation, lockfile, checksum, or provenance information that would allow users to verify the retrieved executable package.

This creates a supply-chain risk if the npm package, a maintainer account, or the associated publishing process is compromised. It may also expose users to unexpected behavior introduced by a future package release.

Attack Path

1. An attacker compromises the clawhub npm package, its maintainer account, or its release pipeline.
2. The attacker publishes a malicious or backdoored release under the legitimate package name.
3. A user runs the documented installation command:

   bash

   npx clawhub install soil-water-management
   

4. npx resolves and downloads the mutable package release.
5. The downloaded package executes with the privileges and environment of the user running the command.
6. Malicious package code may access files, environment variables, network resources, or other resources available to that user.

Impact Assessment

Successful exploitation could permit arbitrary code execution with the privileges of the installing user. The accessible scope may include that user's files, development credentials, environment variables, network access, and writable appli ...[truncated 283 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin clawhub to an exact version that has been reviewed:

   yaml

   install: "npx --yes clawhub@<audited-exact-version> install soil-water-management"
   

2. Do not use version ranges or floating tags such as latest, because they preserve the mutable-code risk.
3. Record and verify package provenance and integrity through the package manager and trusted registry metadata.
4. Use a lockfile or an equivalent reproducible installation mechanism where the surrounding installation platform supports one.
5. Consider installing the audited CLI dependency separately and invoking the trusted local binary rather than allowing npx to download executable code implicitly.
6. Review whether the named Skill installation is also resolved to a mutable release. If supported by ClawHub, pin the Skill itself to an audited version or digest.
7. Run installation with a non-privileged account and restrict access to sensitive credentials and environment variables during the installation process.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The install command uses npx clawhub install soil-water-management without pinning a specific package version or integrity source. This creates a supply-chain risk: a future malicious or compromised release of the referenced package could be executed at install time, and npx commonly fetches and runs remote code.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The activation guidance says to use the skill when someone wants to improve soil, start composting, set up irrigation, harvest rainwater, or scale up food growing, which is broad enough to overlap with many general gardening conversations. The file does not provide exclusion conditions or negative examples clarifying when another skill should be used instead.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.