ClawHub
Back to skill

Security audit

Ai Tools

Security checks for vulnerabilities and agentic risk

Overview

This skill is a mostly static directory of AI-tool links, with caution needed around its unpinned install command and any third-party sites users choose to visit.

Install through a trusted ClawHub workflow and prefer pinned or verified installer versions where available. Treat the listed AI services as third parties: review their policies and avoid pasting sensitive data into them unless you intend to share it with that provider.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:77
Finding

Unpinned Third-Party Package Execution in Installation Instructions

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 77
Vulnerability Type: Unpinned third-party dependency execution
Risk Level: Medium

Vulnerable Code

bash
npx clawhub install ai-tools-waai

Technical Analysis

The documented installation command uses npx to resolve and execute the clawhub package without specifying a version or integrity hash. It then requests installation of ai-tools-waai without pinning that artifact to a reviewed version.

Consequently, the code executed during installation can differ from the code that was originally audited. Package installation may also execute package entry points or lifecycle scripts. If the package, publisher account, registry resolution, or transitive dependency chain is compromised, following the documented command could execute attacker-controlled code.

This installation behavior is not required by the runtime implementation in ai_tools.py, which only provides a static, read-only catalog and requires no third-party Python dependencies.

Attack Path

  1. An attacker compromises the clawhub package, the referenced Skill package, a publisher account, or a transitive dependency.
  2. The attacker publishes a malicious version under the same package identity.
  3. A user follows the installation command from SKILL.md.
  4. npx resolves the current mutable package version because no version or integrity value is specified.
  5. The package manager or installer executes attacker-controlled package code or lifecycle behavior.
  6. The payload runs with the privileges of the user performing the installation.

Impact Assessment

Successful exploitation could permit arbitrary code execution under the installing user's account. Depending on that account's permissions, the payload could access or modify user files, environment variables, credentials available to the process, agent configuration, and installed Skills. If installation is performed by an administrator or in a privil ...[truncated 272 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin clawhub to a specifically reviewed version rather than allowing npx to select the current release.
  2. Pin ai-tools-waai to an immutable version or content digest supported by the installer.
  3. Use a lockfile or registry integrity metadata to verify downloaded package contents.
  4. Document the expected registry, package publisher, version, checksum, and verification procedure.
  5. Prefer downloading and verifying a fixed artifact before executing any installer code.
  6. Disable or restrict package lifecycle scripts where the package manager supports doing so.
  7. Run installation with a minimally privileged account and avoid administrator or root execution.
  8. Periodically audit the pinned package and its complete transitive dependency chain before updating versions.

For example, use the installer's supported version-pinning syntax and verify the artifact checksum before installation. The exact command should be based on documented, supported clawhub package and Skill version syntax rather than an assumed format.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (6)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding

The skill advertises executable CLI usage via python ai_tools.py ... and installation through an external package path, yet it declares no explicit tool scope such as shell permissions or allowed tools. This creates a mismatch between documented behavior and declared constraints, increasing the chance that an agent may invoke shell capabilities without clear policy boundaries or user awareness.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The top-level description is broad enough to match many generic requests such as finding tools, comparing services, or exploring capabilities. Overbroad activation criteria can cause the skill to trigger in contexts where the user did not intend external tool discovery or invocation, increasing the risk of unnecessary data sharing and unsafe tool use.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The usage guidance lists broad scenarios like quick access to AI services and exploring new AI capabilities, but it does not define concrete boundaries, approval steps, or safe defaults. In an agent setting this can encourage opportunistic activation and external service use for routine requests, expanding the attack surface and privacy risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill is expressly designed to search and invoke many third-party AI tools, but it does not warn that user prompts, files, or metadata may be transmitted to external services. Because this skill's core function is routing users to outside providers, the absence of a disclosure and consent model materially increases the risk of privacy leakage, policy violations, and unintended exposure of sensitive data.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
90% confidence
Finding

The installation instruction references npx clawhub without a pinned version, so future executions may fetch and run changed code from the registry. In agent environments, unpinned remote package execution is dangerous because it introduces a supply-chain risk and can silently alter behavior over time.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The module docstring is written as a declarative product description in Chinese only, with no indication that language is configurable or limited to a China-specific audience. Under the policy for natural-language violations, forcing a specific language without user opt-in is reportable.

Content

No source excerpt is available for this finding.