Tenant Rights Housing

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 3:27 AM UTC
• Version: 1.0.0

Overview

This is a tenant-rights guidance skill with expected legal templates and follow-up prompts, with some install and legal-workflow cautions but no evidence of hidden or malicious behavior.

Before installing, prefer a pinned or otherwise trusted ClawHub installer command and run it with normal user privileges. When using the skill, confirm your jurisdiction, dates, court deadlines, and rent-withholding rules with local legal aid or an official tenant resource before taking legal action.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:16

Finding

Unpinned npm Package Is Downloaded and Executed During Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 16
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code

yaml

install: "npx clawhub install tenant-rights-housing"

Technical Analysis

The documented installation command uses npx to invoke the npm-hosted clawhub package without specifying an audited version or verifying a package integrity hash. If the package is not already available locally, npx may download the version currently resolved by the npm registry and execute its package entry point.

Because neither the package version nor its content digest is pinned, the code executed during installation can change after this Skill has been reviewed. Compromise of the upstream package, its publisher account, or the dependency resolution process could therefore introduce arbitrary executable behavior without any corresponding modification to this repository.

Attack Path

1. An attacker compromises the upstream clawhub npm package, its publisher account, or a dependency included in the package.
2. The attacker publishes a malicious version that remains compatible with the unversioned package name.
3. A user or agent follows the installation instruction:

   bash

   npx clawhub install tenant-rights-housing
   

4. npx resolves and downloads the attacker-controlled package version.
5. The package entry point or lifecycle behavior executes with the privileges of the user running the command.
6. The malicious package can perform operations permitted by that account before or while installing the Skill.

Impact Assessment

Successful exploitation could allow arbitrary code execution under the installing user's account. Depending on that account's privileges and environment, an attacker could access user-readable files and credentials, modify local data, invoke network services, or tamper with other development resources. The repository itself does not request elevated privileges, ...[truncated 213 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the installer to a specific, reviewed version, for example:

   bash

   npx --yes clawhub@<audited-version> install tenant-rights-housing
   

2. Verify the selected package version against a trusted integrity digest or signed provenance before execution.
3. Identify the expected official npm registry and publisher in the installation documentation to reduce dependency-confusion and impersonation risks.
4. Use a lockfile where installation occurs within a managed project, and commit the lockfile so transitive dependencies remain reproducible.
5. Prefer separating retrieval from execution: download and inspect the package first, verify its integrity and provenance, and only then invoke its executable.
6. Run installation using a least-privileged account in a sandbox or isolated environment. Do not execute the command with administrator or root privileges.
7. Periodically review the pinned package and its transitive dependencies before deliberately updating the approved version.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 89% confidence

Finding

The install command invokes 'npx clawhub' without pinning an exact package version, which can cause the latest published package to be fetched and executed at install time. If the upstream package is compromised, typosquatted, or changed unexpectedly, users may run unreviewed code, creating a supply-chain execution risk.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The automation triggers use natural-language conditions such as 'deadline has passed without repair' and 'check_at_deadline' without precise state definitions, validation rules, or authorization boundaries. Ambiguous triggers can fire at the wrong time and cause the agent to push legal escalation steps prematurely or inapplicably, which is risky in a legal-advice workflow where timing and jurisdiction-specific prerequisites matter.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.