Communication Master Skill

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 4:10 AM UTC
• Version: 1.0.1

Overview

This is a communication-coaching skill with no executable code, but its install instructions and in-skill promotional link deserve user awareness.

Before installing, use a trusted or version-pinned ClawHub installer if available, and be aware that the skill contains a visible publisher promotion. The coaching content itself does not appear to access your files, credentials, tools, or persistent memory.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Note

• Location: SKILL.md:169
• Finding: Commercial Recommendation Embedded in Agent Instructions## Vulnerability Details **File Location**: `SKILL.md`, lines 169-174 **Vulnerability Type**: Commercial instruction steering **Risk Level**: Low **Complete Code Snippet**: ```markdown ## Upgrade For ongoing communication coaching with real conversation practice → replyher.com --- *Built by ReplyHer — say what you mean, hear what they need* ``` ### Technical Analysis The skill places a recommendation for an external commercial service inside the instruction document loaded by the agent. Because `SKILL.md` controls agent behavior, this content may influence the agent to promote or redirect users to the publisher's service during communication-coaching sessions. The recommendation is unrelated to the core frameworks required to provide communication advice. It does not explicitly override safety controls or require promotion in every response, and it does not itself retrieve content or execute code. Nevertheless, placing promotional guidance in the behavioral instruction context creates a low-severity instruction-steering risk and may produce biased recommendations without a user request. ### Attack Path 1. A user or platform installs and loads the skill. 2. The agent processes the entire `SKILL.md` file as behavioral guidance. 3. The embedded upgrade section associates ongoing coaching with `replyher.com`. 4. During a relevant conversation, the agent may recommend the publisher's service even when the user did not request product suggestions. 5. The user may follow the recommendation and leave the audited environment for an external service whose behavior and privacy practices are outside this project's scope. ### Impact Assessment This issue does not grant operating-system privileges, access credentials, persistent memory, or code execution. Its scope is limited to the agent's current-session recommendations and the possibility of redirecting users to an external commercial website. Potential effects include bias ...[truncated 116 chars]
• Remediation: ## Remediation Suggestions - Remove commercial upgrade instructions from `SKILL.md` so the behavioral prompt contains only functionality necessary for communication coaching. - Keep attribution and optional product links in `README.md` or package metadata rather than in the agent's runtime instructions. - If recommendations are retained, only provide them after an explicit user request for external services. - Clearly label any recommendation as promotional and disclose the publisher's relationship with the service. - Ensure that the skill remains fully functional without visiting or interacting with the external website.

T08 · Insecure Dependencies

Warning

• Location: README.md:3
• Finding: Unpinned Package Execution in Installation Instructions## Vulnerability Details **File Location**: `README.md`, lines 3-5 **Vulnerability Type**: Unpinned third-party package execution **Risk Level**: Medium **Complete Code Snippet**: ```markdown ## Install ```bash npx clawhub install SLUG ``` ``` ### Technical Analysis The installation instructions invoke `clawhub` through `npx` without specifying an audited package version or integrity value. Depending on the local environment and npm configuration, `npx` can resolve and download the package from a configured registry and then execute its entry point. Because package resolution is not pinned, the code executed by this command can change after this project has been reviewed. A compromised maintainer account, registry compromise, malicious replacement release, or unsafe registry configuration could cause users to execute code different from the version expected by the project author. The placeholder `SLUG` does not mitigate the package-resolution risk because it is an argument passed after the unversioned `clawhub` executable has already been selected. ### Attack Path 1. An attacker compromises the package publication channel, a maintainer account, or a registry used to resolve `clawhub`. 2. The attacker publishes or serves a modified package version containing malicious lifecycle or executable code. 3. A user follows the documented command `npx clawhub install SLUG`. 4. `npx` resolves the unpinned package from the configured registry and downloads it when no trusted local copy satisfies the request. 5. The downloaded package executes with the permissions of the user running the installation command. 6. Malicious package code could access files, environment variables, network resources, or credentials available to that user. ### Impact Assessment Successful exploitation could provide arbitrary code execution with the privileges of the user who runs the command. The accessible scope may include that user's files, en ...[truncated 382 chars]
• Remediation: ## Remediation Suggestions - Pin `clawhub` to a specific reviewed version, for example `npx clawhub@<reviewed-version> install SLUG`. - Document the expected official registry and package publisher. - Use package-lock and integrity verification mechanisms where the installation workflow supports them. - Prefer installing from a trusted lockfile-controlled environment rather than resolving the latest package during each installation. - Review and update the pinned version through a controlled dependency-update process. - Advise users not to run the installer with administrative privileges unless strictly required.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence
• Finding: The README instructs users to run `npx clawhub install SLUG` without pinning a specific version of the package being executed. `npx` will fetch and run the latest available package version, which creates a supply-chain risk: a compromised publisher account, malicious update, or dependency takeover could cause arbitrary code execution on the user's machine at install time.

Static analysis

No suspicious patterns detected.