Village Blacksmith Starter

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:13 AM UTC
• Version: 1.0.0

Overview

The skill is coherent and not deceptive, but it should be reviewed carefully because it combines hazardous forge guidance, automatic local file changes, and an unpinned installer command.

Review this before installing if you only want general rural income advice or are not prepared for forge safety risks. If installed, use it only for explicit blacksmithing tasks, confirm before any file writes, keep the generated files in a dedicated workspace, and avoid running the unpinned `npx` installer with elevated privileges.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:10

Finding

Unpinned npm Package Execution in Installation Command

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 10
Vulnerability Type: Unpinned third-party package execution
Risk Level: Medium

Vulnerable Code:

yaml

install: "npx clawhub install village-blacksmith-starter"

Technical Analysis

The installation command invokes clawhub through npx without specifying an exact package version or integrity value. If the package is not already available from a trusted local installation, npx may retrieve and execute the currently resolved version from the configured npm registry.

Consequently, the executable code used during installation can change after this skill has been reviewed. The project does not provide a lockfile, package manifest, integrity hash, or vendored implementation that identifies and verifies the exact clawhub package being executed. This creates a supply-chain trust boundary that is not controlled by the audited project.

Exploitation would require the resolved package or package-distribution channel to become malicious, such as through package maintainer compromise, registry compromise, dependency confusion caused by an unsafe registry configuration, or publication of a malicious replacement version.

Attack Path

1. An attacker compromises the npm package or account associated with the resolved clawhub package, controls a registry selected by the user's npm configuration, or otherwise causes a malicious package version to be resolved.
2. The attacker publishes a version containing malicious installation or runtime code.
3. A user follows the documented command:

   shell

   npx clawhub install village-blacksmith-starter
   

4. npx downloads the attacker-controlled package because the command does not constrain resolution to an audited version and integrity value.
5. npx executes the downloaded CLI in the installing user's security context.
6. The malicious package can perform operations permitted to that us ...[truncated 856 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the installation tool to an exact, reviewed version rather than relying on unconstrained package resolution. For example, use the package manager's explicit package and version syntax:

  shell

  npx --package=clawhub@<audited-version> -- clawhub install village-blacksmith-starter
  

• Verify the precise command syntax supported by the selected package-manager version before publishing it.
• Use a lockfile and npm integrity metadata where installation is managed through a package manifest.
• Configure npm to use an approved HTTPS registry and document the expected package publisher and source repository.
• Review the pinned package, its lifecycle scripts, and its transitive dependencies before trusting it.
• Prefer an already installed and administratively managed CLI in controlled environments, and avoid running the installer with administrator or root privileges.
• Establish an update process in which version changes are reviewed, tested, and explicitly approved before the pinned version is advanced.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Harmful Content Injection

Critical

• Category: Prompt Injection
• Confidence: 90% confidence

Finding

This content may contain harmful instructions that could cause physical harm if followed. CRITICAL: Review carefully before use.

Content

Scanner excerpt · SKILL.md (reported line 60)May include surrounding context.

md

## Rules
- This is not professional trade school training; start with scrap and practice pieces only — never sell anything that could fail and injure someone
- Always have a bucket of water and sand within arm’s reach when the forge is lit
- Never work alone the first 30 days — have at least one other person within shouting distance
- Do not use unknown scrap that might be high-carbon or galvanized until you can identify it safely
- If you burn yourself or inhale too much smoke, stop for the day and treat it immediately

## Tips
- Village customers will pay more for same-day repair than for new items — always fix their broken tool first and offer to make a stronger replacement later.
- The single best “marketing” move is to repair one free item for the village store owner or biggest farmer — word spreads faster than any sign.
- Counterintuitive: Using slightly cooler orange heat and more hammer blows produces cleaner work than white-hot blazing — it also saves charcoal and reduces scale.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The skill metadata includes an install command using npx clawhub install village-blacksmith-starter without pinning a specific package version. Unpinned npx execution can fetch and run whatever code is current at install time, creating a supply-chain risk if the package is updated maliciously, compromised, or changes behavior unexpectedly.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The activation criteria are broad enough to match many ordinary rural, survival, or income-seeking situations, which can cause the agent to invoke this skill in contexts where the user did not explicitly ask for blacksmithing guidance. Because the skill contains instructions for fire use, metalworking, and file-modifying agent actions, overbroad triggering increases the chance of unsafe or irrelevant automation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill repeatedly instructs the agent to create and update local files such as blacksmith-setup.md, daily-practice-log.md, and income-log.md without telling the user in advance or asking for consent. This can lead to unexpected filesystem changes, confusion about persistent artifacts, and possible overwriting of user content in environments where filesystem access is available.

Content

No source excerpt is available for this finding.