Traditional Bone Tool Making Basics

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 4:40 AM UTC
• Version: 1.0.0

Overview

The skill is a coherent craft workflow with disclosed filesystem use for logs and templates, with a noteworthy but generic unpinned install-command supply-chain risk.

Install from a trusted ClawHub/npm source, prefer a version-pinned installer when available, and run the skill in a dedicated workspace. Expect it to store craft photos, progress logs, templates, and reminders, and follow the disclosed physical safety cautions for boiling, cutting, drilling, and bone dust.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:15

Finding

Unpinned npm Package Execution Through npx

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 15 and 24
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code

Line 15:

yaml

install: "npx clawhub install traditional-bone-tool-making-basics"

Line 24:

shell

npx clawhub install traditional-bone-tool-making-basics

Technical Analysis

The installation instructions execute the clawhub npm package through npx without specifying a reviewed version or integrity value. If the package is not already available locally, npx may retrieve and execute the version currently resolved from the configured npm registry.

Because the package version is unpinned, the code executed during installation can change after this Skill has been reviewed. The effective installation behavior therefore depends on mutable third-party registry content rather than solely on the audited project.

This creates a software supply-chain risk. A compromised package publisher account, malicious package release, registry compromise, or unexpected dependency update could introduce arbitrary code into the installation process.

Attack Path

1. An attacker compromises the publisher account, release process, or registry entry associated with the clawhub npm package.
2. The attacker publishes a modified package version containing malicious installation or runtime behavior.
3. A user follows the installation command documented in SKILL.md.
4. npx resolves and downloads the attacker-controlled or compromised package version.
5. The package executes under the identity and permissions of the user running the command.
6. The malicious package can access resources available to that user, subject to operating-system controls and the execution environment.

Impact Assessment

Successful exploitation could result in arbitrary code execution with the privileges of the invoking user. Depending on those privileges and the ...[truncated 450 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin clawhub to a specifically reviewed version instead of allowing npx to resolve the latest release:

   shell

   npx clawhub@<reviewed-version> install traditional-bone-tool-making-basics
   

2. Verify the selected package version's provenance, publisher identity, release signatures, and npm integrity metadata before documenting it.
3. Use an approved registry or internal package mirror that permits only vetted package versions.
4. Prefer a lockfile-backed, reproducible installation workflow where practical.
5. Run installation with least privilege in an isolated environment without unnecessary credentials or access to sensitive files.
6. Periodically review the pinned package and its transitive dependencies before updating the documented version.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The skill instructs users to run npx clawhub install traditional-bone-tool-making-basics without pinning a specific package version. This allows the command to fetch whatever version is current at execution time, creating a supply-chain risk where a compromised or newly malicious release could execute unexpected code on the user's system.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

This repeated unpinned npx clawhub invocation has the same supply-chain exposure as the metadata install command: it resolves code dynamically at runtime rather than to a reviewed, immutable version. If the upstream package or dependency chain is hijacked, users may execute attacker-controlled code merely by following the skill instructions.

Content

No source excerpt is available for this finding.